Edit tour

Windows Analysis Report
shipping_documents.exe

Overview

General Information

Sample Name:	shipping_documents.exe
Analysis ID:	830622
MD5:	5ec19c18eff49f78ce02e2cf1831c37d
SHA1:	9d7261d0e2558dd6bd26373c4e2421ad83af6b19
SHA256:	ee9c3569905a2a2b5141982928e9205a99170189dab43f8626102e1a6dddbe4e
Tags:	agentteslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Sigma detected: Scheduled temp file as task from temp location

Multi AV Scanner detection for dropped file

Installs a global keyboard hook

Tries to steal Mail credentials (via file / registry access)

Initial sample is a PE file and has a suspicious name

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Modifies the hosts file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Creates a window with clipboard capturing capabilities

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

shipping_documents.exe (PID: 64 cmdline: C:\Users\user\Desktop\shipping_documents.exe MD5: 5EC19C18EFF49F78CE02E2CF1831C37D)

schtasks.exe (PID: 6132 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

shipping_documents.exe (PID: 1092 cmdline: {path} MD5: 5EC19C18EFF49F78CE02E2CF1831C37D)

shipping_documents.exe (PID: 1364 cmdline: {path} MD5: 5EC19C18EFF49F78CE02E2CF1831C37D)

shipping_documents.exe (PID: 1544 cmdline: {path} MD5: 5EC19C18EFF49F78CE02E2CF1831C37D)

vOqVEnqC.exe (PID: 1248 cmdline: C:\Users\user\AppData\Roaming\vOqVEnqC.exe MD5: 5EC19C18EFF49F78CE02E2CF1831C37D)

schtasks.exe (PID: 4436 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp243C.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vOqVEnqC.exe (PID: 1324 cmdline: {path} MD5: 5EC19C18EFF49F78CE02E2CF1831C37D)

LIhMQ.exe (PID: 244 cmdline: "C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe" MD5: 5EC19C18EFF49F78CE02E2CF1831C37D)

schtasks.exe (PID: 5968 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmpE4E1.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5860 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

LIhMQ.exe (PID: 4544 cmdline: {path} MD5: 5EC19C18EFF49F78CE02E2CF1831C37D)

LIhMQ.exe (PID: 2280 cmdline: {path} MD5: 5EC19C18EFF49F78CE02E2CF1831C37D)

LIhMQ.exe (PID: 2852 cmdline: "C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe" MD5: 5EC19C18EFF49F78CE02E2CF1831C37D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based keylogger and RAT readily available to actors. Logs keystrokes and the host's clipboard and beacons this information back to the C2.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/ https://blog.apnic.net/2022/03/31/how-to-detect-and-prevent-common-data-exfiltration-attacks/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.clipjoint.co.nz", "Username": "clipjoint@clipjoint.co.nz", "Password": "melandloz64"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.590317910.0000000002E49000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.579676048.0000000000430000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x1f7c:$a13: get_DnsResolver 0x71d:$a20: get_LastAccessed 0x824:$a33: get_Clipboard 0x832:$a34: get_Keyboard 0x1b97:$a35: get_ShiftKeyDown 0x1ba8:$a36: get_AltKeyDown 0x83f:$a37: get_Password 0x132f:$a38: get_PasswordHash
00000005.00000002.573256271.0000000004446000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000005.00000002.573256271.0000000004446000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000005.00000002.573256271.0000000004446000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x30c8c:$a13: get_DnsResolver 0x650ac:$a13: get_DnsResolver 0x2f42d:$a20: get_LastAccessed 0x6384d:$a20: get_LastAccessed 0x3161e:$a27: set_InternalServerPort 0x65a3e:$a27: set_InternalServerPort 0x3193b:$a30: set_GuidMasterKey 0x65d5b:$a30: set_GuidMasterKey 0x2f534:$a33: get_Clipboard 0x63954:$a33: get_Clipboard 0x2f542:$a34: get_Keyboard 0x63962:$a34: get_Keyboard 0x308a7:$a35: get_ShiftKeyDown 0x64cc7:$a35: get_ShiftKeyDown 0x308b8:$a36: get_AltKeyDown 0x64cd8:$a36: get_AltKeyDown 0x2f54f:$a37: get_Password 0x6396f:$a37: get_Password 0x3003f:$a38: get_PasswordHash 0x6445f:$a38: get_PasswordHash 0x31089:$a39: get_DefaultCredentials
00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x13cc3c:$a13: get_DnsResolver 0x17105c:$a13: get_DnsResolver 0x13b3dd:$a20: get_LastAccessed 0x16f7fd:$a20: get_LastAccessed 0x13d5ce:$a27: set_InternalServerPort 0x1719ee:$a27: set_InternalServerPort 0x13d8eb:$a30: set_GuidMasterKey 0x171d0b:$a30: set_GuidMasterKey 0x13b4e4:$a33: get_Clipboard 0x16f904:$a33: get_Clipboard 0x13b4f2:$a34: get_Keyboard 0x16f912:$a34: get_Keyboard 0x13c857:$a35: get_ShiftKeyDown 0x170c77:$a35: get_ShiftKeyDown 0x13c868:$a36: get_AltKeyDown 0x170c88:$a36: get_AltKeyDown 0x13b4ff:$a37: get_Password 0x16f91f:$a37: get_Password 0x13bfef:$a38: get_PasswordHash 0x17040f:$a38: get_PasswordHash 0x13d039:$a39: get_DefaultCredentials
0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.591331951.00000000030B0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.593114242.000000000315F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: shipping_documents.exe PID: 64	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: shipping_documents.exe PID: 64	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: shipping_documents.exe PID: 64	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x9f332:$a13: get_DnsResolver 0x9dd33:$a20: get_LastAccessed 0x9fc79:$a27: set_InternalServerPort 0x9fedc:$a30: set_GuidMasterKey 0x9de26:$a33: get_Clipboard 0x9de34:$a34: get_Keyboard 0x9efec:$a35: get_ShiftKeyDown 0x9effd:$a36: get_AltKeyDown 0x9de41:$a37: get_Password 0x9e88d:$a38: get_PasswordHash 0x9f706:$a39: get_DefaultCredentials
Process Memory Space: vOqVEnqC.exe PID: 1248	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vOqVEnqC.exe PID: 1248	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vOqVEnqC.exe PID: 1248	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x63e05:$a13: get_DnsResolver 0x62806:$a20: get_LastAccessed 0x6474c:$a27: set_InternalServerPort 0x649af:$a30: set_GuidMasterKey 0x628f9:$a33: get_Clipboard 0x62907:$a34: get_Keyboard 0x63abf:$a35: get_ShiftKeyDown 0x63ad0:$a36: get_AltKeyDown 0x62914:$a37: get_Password 0x63360:$a38: get_PasswordHash 0x641d9:$a39: get_DefaultCredentials
Process Memory Space: shipping_documents.exe PID: 1544	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: shipping_documents.exe PID: 1544	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: shipping_documents.exe PID: 1544	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0xdcbc:$a13: get_DnsResolver 0xc6bd:$a20: get_LastAccessed 0xc7b0:$a33: get_Clipboard 0xc7be:$a34: get_Keyboard 0xd976:$a35: get_ShiftKeyDown 0xd987:$a36: get_AltKeyDown 0xc7cb:$a37: get_Password 0xd217:$a38: get_PasswordHash
Process Memory Space: LIhMQ.exe PID: 244	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: LIhMQ.exe PID: 2280	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: LIhMQ.exe PID: 2280	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vOqVEnqC.exe PID: 1324	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vOqVEnqC.exe PID: 1324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 26 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.vOqVEnqC.exe.4446b10.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.vOqVEnqC.exe.4446b10.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
5.2.vOqVEnqC.exe.4446b10.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30c63:$s10: logins 0x306bf:$s11: credential 0x2cc24:$g1: get_Clipboard 0x2cc32:$g2: get_Keyboard 0x2cc3f:$g3: get_Password 0x2df87:$g4: get_CtrlKeyDown 0x2df97:$g5: get_ShiftKeyDown 0x2dfa8:$g6: get_AltKeyDown
5.2.vOqVEnqC.exe.4446b10.3.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2e37c:$a13: get_DnsResolver 0x2cb1d:$a20: get_LastAccessed 0x2ed0e:$a27: set_InternalServerPort 0x2f02b:$a30: set_GuidMasterKey 0x2cc24:$a33: get_Clipboard 0x2cc32:$a34: get_Keyboard 0x2df97:$a35: get_ShiftKeyDown 0x2dfa8:$a36: get_AltKeyDown 0x2cc3f:$a37: get_Password 0x2d72f:$a38: get_PasswordHash 0x2e779:$a39: get_DefaultCredentials
5.2.vOqVEnqC.exe.4446b10.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
5.2.vOqVEnqC.exe.4446b10.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
5.2.vOqVEnqC.exe.4446b10.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32a63:$s10: logins 0x66e83:$s10: logins 0x324bf:$s11: credential 0x668df:$s11: credential 0x2ea24:$g1: get_Clipboard 0x62e44:$g1: get_Clipboard 0x2ea32:$g2: get_Keyboard 0x62e52:$g2: get_Keyboard 0x2ea3f:$g3: get_Password 0x62e5f:$g3: get_Password 0x2fd87:$g4: get_CtrlKeyDown 0x641a7:$g4: get_CtrlKeyDown 0x2fd97:$g5: get_ShiftKeyDown 0x641b7:$g5: get_ShiftKeyDown 0x2fda8:$g6: get_AltKeyDown 0x641c8:$g6: get_AltKeyDown
5.2.vOqVEnqC.exe.4446b10.3.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x3017c:$a13: get_DnsResolver 0x6459c:$a13: get_DnsResolver 0x2e91d:$a20: get_LastAccessed 0x62d3d:$a20: get_LastAccessed 0x30b0e:$a27: set_InternalServerPort 0x64f2e:$a27: set_InternalServerPort 0x30e2b:$a30: set_GuidMasterKey 0x6524b:$a30: set_GuidMasterKey 0x2ea24:$a33: get_Clipboard 0x62e44:$a33: get_Clipboard 0x2ea32:$a34: get_Keyboard 0x62e52:$a34: get_Keyboard 0x2fd97:$a35: get_ShiftKeyDown 0x641b7:$a35: get_ShiftKeyDown 0x2fda8:$a36: get_AltKeyDown 0x641c8:$a36: get_AltKeyDown 0x2ea3f:$a37: get_Password 0x62e5f:$a37: get_Password 0x2f52f:$a38: get_PasswordHash 0x6394f:$a38: get_PasswordHash 0x30579:$a39: get_DefaultCredentials
0.2.shipping_documents.exe.39e5ac0.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping_documents.exe.39e5ac0.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping_documents.exe.39e5ac0.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30c63:$s10: logins 0x306bf:$s11: credential 0x2cc24:$g1: get_Clipboard 0x2cc32:$g2: get_Keyboard 0x2cc3f:$g3: get_Password 0x2df87:$g4: get_CtrlKeyDown 0x2df97:$g5: get_ShiftKeyDown 0x2dfa8:$g6: get_AltKeyDown
0.2.shipping_documents.exe.39e5ac0.3.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x2e37c:$a13: get_DnsResolver 0x2cb1d:$a20: get_LastAccessed 0x2ed0e:$a27: set_InternalServerPort 0x2f02b:$a30: set_GuidMasterKey 0x2cc24:$a33: get_Clipboard 0x2cc32:$a34: get_Keyboard 0x2df97:$a35: get_ShiftKeyDown 0x2dfa8:$a36: get_AltKeyDown 0x2cc3f:$a37: get_Password 0x2d72f:$a38: get_PasswordHash 0x2e779:$a39: get_DefaultCredentials
0.2.shipping_documents.exe.39e5ac0.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.shipping_documents.exe.39e5ac0.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.shipping_documents.exe.39e5ac0.3.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2f499:$s2: GetPrivateProfileString 0x638b9:$s2: GetPrivateProfileString 0x2ed1b:$s3: get_OSFullName 0x6313b:$s3: get_OSFullName 0x2f52f:$s4: get_PasswordHash 0x6394f:$s4: get_PasswordHash 0x27109a:$s5: remove_Key 0x30b2a:$s6: FtpWebRequest 0x64f4a:$s6: FtpWebRequest 0x32a63:$s7: logins 0x66e83:$s7: logins
0.2.shipping_documents.exe.39e5ac0.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32a63:$s10: logins 0x66e83:$s10: logins 0x324bf:$s11: credential 0x668df:$s11: credential 0x2ea24:$g1: get_Clipboard 0x62e44:$g1: get_Clipboard 0x2ea32:$g2: get_Keyboard 0x62e52:$g2: get_Keyboard 0x2ea3f:$g3: get_Password 0x62e5f:$g3: get_Password 0x2fd87:$g4: get_CtrlKeyDown 0x641a7:$g4: get_CtrlKeyDown 0x2fd97:$g5: get_ShiftKeyDown 0x641b7:$g5: get_ShiftKeyDown 0x2fda8:$g6: get_AltKeyDown 0x641c8:$g6: get_AltKeyDown
0.2.shipping_documents.exe.39e5ac0.3.raw.unpack	Windows_Trojan_AgentTesla_d3ac2b2f	unknown	unknown	0x3017c:$a13: get_DnsResolver 0x6459c:$a13: get_DnsResolver 0x2e91d:$a20: get_LastAccessed 0x62d3d:$a20: get_LastAccessed 0x30b0e:$a27: set_InternalServerPort 0x64f2e:$a27: set_InternalServerPort 0x30e2b:$a30: set_GuidMasterKey 0x6524b:$a30: set_GuidMasterKey 0x2ea24:$a33: get_Clipboard 0x62e44:$a33: get_Clipboard 0x2ea32:$a34: get_Keyboard 0x62e52:$a34: get_Keyboard 0x2fd97:$a35: get_ShiftKeyDown 0x641b7:$a35: get_ShiftKeyDown 0x2fda8:$a36: get_AltKeyDown 0x641c8:$a36: get_AltKeyDown 0x2ea3f:$a37: get_Password 0x62e5f:$a37: get_Password 0x2f52f:$a38: get_PasswordHash 0x6394f:$a38: get_PasswordHash 0x30579:$a39: get_DefaultCredentials
Click to see the 12 entries

Sigma Signatures

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\Desktop\shipping_documents.exe, ParentImage: C:\Users\user\Desktop\shipping_documents.exe, ParentProcessId: 64, ParentProcessName: shipping_documents.exe, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp, ProcessId: 6132, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: shipping_documents.exe

ReversingLabs: Detection: 53%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	ReversingLabs: Detection: 53%
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	ReversingLabs: Detection: 53%

Machine Learning detection for sample

Source: shipping_documents.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Joe Sandbox ML: detected

Source: 5.2.vOqVEnqC.exe.4446b10.3.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.clipjoint.co.nz", "Username": "clipjoint@clipjoint.co.nz", "Password": "melandloz64"}

Source: shipping_documents.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: shipping_documents.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: i2QOV.pdbx" source: shipping_documents.exe, vOqVEnqC.exe.0.dr, LIhMQ.exe.6.dr
Source:	Binary string: i2QOV.pdb source: shipping_documents.exe, vOqVEnqC.exe.0.dr, LIhMQ.exe.6.dr

Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	0_2_0746F728
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	5_2_0791F5C8
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h	5_2_0791FE40

Source: Joe Sandbox View

IP Address: 27.54.86.236 27.54.86.236

Source: global traffic

TCP traffic: 192.168.2.5:49699 -> 27.54.86.236:587

Source: global traffic

TCP traffic: 192.168.2.5:49699 -> 27.54.86.236:587

Source: shipping_documents.exe, 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://MFxeXD.com
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: shipping_documents.exe, 00000006.00000002.590317910.0000000002E49000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.0000000003102000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.00000000031AA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.clipjoint.co.nz
Source: shipping_documents.exe, 00000000.00000002.368254562.00000000075F1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000005.00000002.518134460.0000000003222000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: shipping_documents.exe, 00000000.00000002.350966478.0000000001117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: shipping_documents.exe, 00000000.00000002.350966478.0000000001117000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comceF
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp, shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: shipping_documents.exe, 00000000.00000003.304079093.000000000111D000.00000004.00000020.00020000.00000000.sdmp, shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: shipping_documents.exe, 00000000.00000003.304079093.000000000111D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comcagE
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: vOqVEnqC.exe, 00000011.00000002.593114242.000000000315F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://RGpFrRyIJy6rRTyqEb.net
Source: shipping_documents.exe, 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%
Source: shipping_documents.exe, 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org%mail.clipjoint.co.nzclipjoint
Source: shipping_documents.exe, 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

DNS traffic detected: queries for: mail.clipjoint.co.nz

Key, Mouse, Clipboard, Microphone and Screen Capturing

Installs a global keyboard hook

Source: C:\Users\user\Desktop\shipping_documents.exe	Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\shipping_documents.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe

Source: shipping_documents.exe, 00000000.00000002.349816544.0000000000C38000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\shipping_documents.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Window created: window name: CLIPBRDWNDCLASS

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\Desktop\shipping_documents.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.vOqVEnqC.exe.4446b10.3.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.2.vOqVEnqC.exe.4446b10.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 5.2.vOqVEnqC.exe.4446b10.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 5.2.vOqVEnqC.exe.4446b10.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.shipping_documents.exe.39e5ac0.3.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.shipping_documents.exe.39e5ac0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 0.2.shipping_documents.exe.39e5ac0.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.shipping_documents.exe.39e5ac0.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.shipping_documents.exe.39e5ac0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000006.00000002.579676048.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000005.00000002.573256271.0000000004446000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: 00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: shipping_documents.exe PID: 64, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: vOqVEnqC.exe PID: 1248, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown
Source: Process Memory Space: shipping_documents.exe PID: 1544, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: shipping_documents.exe

Source: shipping_documents.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 5.2.vOqVEnqC.exe.4446b10.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.2.vOqVEnqC.exe.4446b10.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 5.2.vOqVEnqC.exe.4446b10.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 5.2.vOqVEnqC.exe.4446b10.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.shipping_documents.exe.39e5ac0.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.shipping_documents.exe.39e5ac0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 0.2.shipping_documents.exe.39e5ac0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.shipping_documents.exe.39e5ac0.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.shipping_documents.exe.39e5ac0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000006.00000002.579676048.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000005.00000002.573256271.0000000004446000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: 00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: shipping_documents.exe PID: 64, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: vOqVEnqC.exe PID: 1248, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20
Source: Process Memory Space: shipping_documents.exe PID: 1544, type: MEMORYSTR	Matched rule: Windows_Trojan_AgentTesla_d3ac2b2f reference_sample = 65463161760af7ab85f5c475a0f7b1581234a1e714a2c5a555783bdd203f85f4, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.AgentTesla, fingerprint = cbbb56fe6cd7277ae9595a10e05e2ce535a4e6bf205810be0bbce3a883b6f8bc, id = d3ac2b2f-14fc-4851-8a57-41032e386aeb, last_modified = 2022-06-20

Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_00BCC504	0_2_00BCC504
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_00BCE7F8	0_2_00BCE7F8
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_00BCE7E8	0_2_00BCE7E8
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_0746BD70	0_2_0746BD70
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07467CA8	0_2_07467CA8
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07460040	0_2_07460040
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07467810	0_2_07467810
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07466F60	0_2_07466F60
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07469F18	0_2_07469F18
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07467F18	0_2_07467F18
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07466F24	0_2_07466F24
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07467F28	0_2_07467F28
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07462FA8	0_2_07462FA8
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07462FB8	0_2_07462FB8
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07463600	0_2_07463600
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07463610	0_2_07463610
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07461E28	0_2_07461E28
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07461E38	0_2_07461E38
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07463420	0_2_07463420
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07463430	0_2_07463430
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07467C97	0_2_07467C97
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07468BCF	0_2_07468BCF
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07468BE0	0_2_07468BE0
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07461392	0_2_07461392
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_074613A0	0_2_074613A0
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_0746BA80	0_2_0746BA80
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_074641C3	0_2_074641C3
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_074641C8	0_2_074641C8
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07463190	0_2_07463190
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_074631A0	0_2_074631A0
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07460006	0_2_07460006
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07467802	0_2_07467802
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_0746C018	0_2_0746C018
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_02F3E7F8	5_2_02F3E7F8
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_02F3E7E8	5_2_02F3E7E8
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_02F3C504	5_2_02F3C504
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07917CA8	5_2_07917CA8
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_0791BCE0	5_2_0791BCE0
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07910040	5_2_07910040
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_0791BF88	5_2_0791BF88
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07912FB8	5_2_07912FB8
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07912FA8	5_2_07912FA8
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07919F18	5_2_07919F18
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07917F18	5_2_07917F18
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07916F24	5_2_07916F24
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07917F28	5_2_07917F28
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07916F60	5_2_07916F60
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07913610	5_2_07913610
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07913600	5_2_07913600
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07911E38	5_2_07911E38
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07911E28	5_2_07911E28
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07917C97	5_2_07917C97
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07913430	5_2_07913430
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07913420	5_2_07913420
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07911392	5_2_07911392
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_079113A0	5_2_079113A0
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07918BCF	5_2_07918BCF
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07918BE0	5_2_07918BE0
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07913190	5_2_07913190
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_079131A0	5_2_079131A0
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_079141C8	5_2_079141C8
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_0791B9F0	5_2_0791B9F0
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07914118	5_2_07914118
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07917810	5_2_07917810
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07917802	5_2_07917802
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07910006	5_2_07910006
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_0118F6E0	6_2_0118F6E0
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_0118FA28	6_2_0118FA28
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062A8A84	6_2_062A8A84
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062AA328	6_2_062AA328
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062A3002	6_2_062A3002
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062A8060	6_2_062A8060
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062A0040	6_2_062A0040
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062A61B0	6_2_062A61B0
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062AB288	6_2_062AB288
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062AB2F0	6_2_062AB2F0
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062AA327	6_2_062AA327
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062AE8DA	6_2_062AE8DA
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_0656DEC8	6_2_0656DEC8
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_0656C818	6_2_0656C818
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_0656ACF8	6_2_0656ACF8

Source: shipping_documents.exe, 00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename159a3513-189a-4a39-a83d-9c07ca495265.exe4 vs shipping_documents.exe
Source: shipping_documents.exe, 00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs shipping_documents.exe
Source: shipping_documents.exe, 00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamei2QOV.exe: vs shipping_documents.exe
Source: shipping_documents.exe, 00000000.00000002.349816544.0000000000C38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs shipping_documents.exe
Source: shipping_documents.exe, 00000000.00000002.368254562.00000000075F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename159a3513-189a-4a39-a83d-9c07ca495265.exe4 vs shipping_documents.exe
Source: shipping_documents.exe, 00000000.00000000.299936176.0000000000574000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamei2QOV.exe: vs shipping_documents.exe
Source: shipping_documents.exe, 00000000.00000002.362172177.00000000048D0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs shipping_documents.exe
Source: shipping_documents.exe, 00000006.00000002.581226304.00000000009E8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs shipping_documents.exe
Source: shipping_documents.exe	Binary or memory string: OriginalFilenamei2QOV.exe: vs shipping_documents.exe

Source: shipping_documents.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: vOqVEnqC.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: LIhMQ.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: shipping_documents.exe

ReversingLabs: Detection: 53%

Source: C:\Users\user\Desktop\shipping_documents.exe

File read: C:\Users\user\Desktop\shipping_documents.exe

Jump to behavior

Source: shipping_documents.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\shipping_documents.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\shipping_documents.exe C:\Users\user\Desktop\shipping_documents.exe
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Users\user\Desktop\shipping_documents.exe {path}
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Users\user\Desktop\shipping_documents.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\vOqVEnqC.exe C:\Users\user\AppData\Roaming\vOqVEnqC.exe
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Users\user\Desktop\shipping_documents.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe "C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe "C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe"
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmpE4E1.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process created: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe {path}
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process created: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe {path}
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp243C.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process created: C:\Users\user\AppData\Roaming\vOqVEnqC.exe {path}
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Users\user\Desktop\shipping_documents.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Users\user\Desktop\shipping_documents.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Users\user\Desktop\shipping_documents.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp243C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process created: C:\Users\user\AppData\Roaming\vOqVEnqC.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmpE4E1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process created: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process created: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\shipping_documents.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\shipping_documents.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\shipping_documents.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\shipping_documents.exe

File created: C:\Users\user\AppData\Roaming\vOqVEnqC.exe

Jump to behavior

Source: C:\Users\user\Desktop\shipping_documents.exe

File created: C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@25/10@3/1

Source: C:\Users\user\Desktop\shipping_documents.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: shipping_documents.exe, 00000006.00000002.590317910.0000000002DFF000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.00000000030AB000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.000000000315A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: shipping_documents.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\shipping_documents.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6124:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5860:120:WilError_01
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Mutant created: \Sessions\1\BaseNamedObjects\KEXpxe
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:472:120:WilError_01

Source: shipping_documents.exe

String found in binary or memory: WPlease check that the folder and files are in this location. If not, please uninstal and re-install the program. If this issue continues, please contact technical support.9\BlueSkyGlobal\UpdateImages\/Please insert your USB.

Source: C:\Users\user\Desktop\shipping_documents.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\Desktop\shipping_documents.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\shipping_documents.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: shipping_documents.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: shipping_documents.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: shipping_documents.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: i2QOV.pdbx" source: shipping_documents.exe, vOqVEnqC.exe.0.dr, LIhMQ.exe.6.dr
Source:	Binary string: i2QOV.pdb source: shipping_documents.exe, vOqVEnqC.exe.0.dr, LIhMQ.exe.6.dr

Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 0_2_07461390 pushad ; iretd	0_2_07461391
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Code function: 5_2_07911390 pushad ; iretd	5_2_07911391
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062A581A push FFFFFF8Bh; retf	6_2_062A581C
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062A78D5 push eax; retf	6_2_062A78D7
Source: C:\Users\user\Desktop\shipping_documents.exe	Code function: 6_2_062A71FD push cs; retf 8B05h	6_2_062A724E

Source: initial sample	Static PE information: section name: .text entropy: 7.446877411021773
Source: initial sample	Static PE information: section name: .text entropy: 7.446877411021773
Source: initial sample	Static PE information: section name: .text entropy: 7.446877411021773

Source: C:\Users\user\Desktop\shipping_documents.exe	File created: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe			Jump to dropped file
Source: C:\Users\user\Desktop\shipping_documents.exe	File created: C:\Users\user\AppData\Roaming\vOqVEnqC.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\shipping_documents.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp

Source: C:\Users\user\Desktop\shipping_documents.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run LIhMQ			Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run LIhMQ			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\shipping_documents.exe	File opened: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	File opened: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe:Zone.Identifier read attributes \| delete

Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping_documents.exe PID: 64, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vOqVEnqC.exe PID: 1248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIhMQ.exe PID: 244, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: shipping_documents.exe, 00000000.00000002.368254562.00000000078E1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000005.00000002.518134460.0000000003222000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: shipping_documents.exe, 00000000.00000002.368254562.00000000078E1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000005.00000002.518134460.0000000003222000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\shipping_documents.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\shipping_documents.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\shipping_documents.exe TID: 5880	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe TID: 4968	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe TID: 5800	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe TID: 4012	Thread sleep count: 9742 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe TID: 5928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe TID: 5044	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe TID: 3804	Thread sleep count: 9448 > 30
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe TID: 5364	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe TID: 5416	Thread sleep count: 5854 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\shipping_documents.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\shipping_documents.exe	Window / User API: threadDelayed 9742	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Window / User API: threadDelayed 9448
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Window / User API: threadDelayed 5854

Source: C:\Users\user\Desktop\shipping_documents.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\shipping_documents.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\shipping_documents.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\shipping_documents.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Thread delayed: delay time: 922337203685477

Source: LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: LIhMQ.exe, 0000000E.00000002.637583427.0000000006D1F000.00000004.00000020.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000003.549988407.0000000006D14000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll\
Source: LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: vOqVEnqC.exe, 00000011.00000002.634694904.0000000006570000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\shipping_documents.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\shipping_documents.exe

Code function: 6_2_062A2508 LdrInitializeThunk,

6_2_062A2508

Source: C:\Users\user\Desktop\shipping_documents.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Modifies the hosts file

Source: C:\Users\user\Desktop\shipping_documents.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\shipping_documents.exe	Memory written: C:\Users\user\Desktop\shipping_documents.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Memory written: C:\Users\user\AppData\Roaming\vOqVEnqC.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Memory written: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe base: 400000 value starts with: 4D5A	Jump to behavior

Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Users\user\Desktop\shipping_documents.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Users\user\Desktop\shipping_documents.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Process created: C:\Users\user\Desktop\shipping_documents.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp243C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Process created: C:\Users\user\AppData\Roaming\vOqVEnqC.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmpE4E1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process created: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Process created: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Users\user\Desktop\shipping_documents.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Users\user\AppData\Roaming\vOqVEnqC.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Users\user\Desktop\shipping_documents.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Users\user\AppData\Roaming\vOqVEnqC.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\vOqVEnqC.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation

Source: C:\Users\user\Desktop\shipping_documents.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\Desktop\shipping_documents.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 5.2.vOqVEnqC.exe.4446b10.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vOqVEnqC.exe.4446b10.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping_documents.exe.39e5ac0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping_documents.exe.39e5ac0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.573256271.0000000004446000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.590317910.0000000002E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.591331951.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.593114242.000000000315F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping_documents.exe PID: 64, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vOqVEnqC.exe PID: 1248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shipping_documents.exe PID: 1544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIhMQ.exe PID: 2280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vOqVEnqC.exe PID: 1324, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\shipping_documents.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\shipping_documents.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\shipping_documents.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Source: Yara match	File source: 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping_documents.exe PID: 1544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIhMQ.exe PID: 2280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vOqVEnqC.exe PID: 1324, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 5.2.vOqVEnqC.exe.4446b10.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vOqVEnqC.exe.4446b10.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping_documents.exe.39e5ac0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.shipping_documents.exe.39e5ac0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.573256271.0000000004446000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.590317910.0000000002E49000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.591331951.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.593114242.000000000315F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: shipping_documents.exe PID: 64, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vOqVEnqC.exe PID: 1248, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: shipping_documents.exe PID: 1544, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: LIhMQ.exe PID: 2280, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vOqVEnqC.exe PID: 1324, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 File and Directory Permissions Modification	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	111 Input Capture	114 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	3 Obfuscated Files or Information	1 Credentials in Registry	311 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	111 Input Capture	Scheduled Transfer	11 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	131 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	111 Process Injection	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Hidden Files and Directories	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
shipping_documents.exe	54%	ReversingLabs	Win32.Trojan.Leonem
shipping_documents.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\vOqVEnqC.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe	54%	ReversingLabs	Win32.Trojan.Leonem
C:\Users\user\AppData\Roaming\vOqVEnqC.exe	54%	ReversingLabs	Win32.Trojan.Leonem

Source	Detection	Scanner	Label
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	URL Reputation	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://api.ipify.org%	0%	URL Reputation	safe
http://www.sajatypeworks.comcagE	0%	Avira URL Cloud	safe
http://www.fontbureau.comceF	0%	Avira URL Cloud	safe
https://api.ipify.org%mail.clipjoint.co.nzclipjoint	0%	Avira URL Cloud	safe
http://MFxeXD.com	0%	Avira URL Cloud	safe
https://RGpFrRyIJy6rRTyqEb.net	0%	Avira URL Cloud	safe
http://mail.clipjoint.co.nz	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.clipjoint.co.nz	27.54.86.236	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	shipping_documents.exe, 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.apache.org/licenses/LICENSE-2.0	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designersG	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comceF	shipping_documents.exe, 00000000.00000002.350966478.0000000001117000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers?	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.clipjoint.co.nz	shipping_documents.exe, 00000006.00000002.590317910.0000000002E49000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.0000000003102000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.00000000031AA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	shipping_documents.exe, 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://MFxeXD.com	vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.coma	shipping_documents.exe, 00000000.00000002.350966478.0000000001117000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	shipping_documents.exe, 00000000.00000003.304079093.000000000111D000.00000004.00000020.00020000.00000000.sdmp, shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/cThe	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.comcagE	shipping_documents.exe, 00000000.00000003.304079093.000000000111D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp, shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%mail.clipjoint.co.nzclipjoint	shipping_documents.exe, 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fonts.com	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	shipping_documents.exe, 00000000.00000002.364622865.0000000006A62000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	shipping_documents.exe, 00000000.00000002.368254562.00000000075F1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000005.00000002.518134460.0000000003222000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	shipping_documents.exe, 00000000.00000002.364622865.0000000006B55000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org%	shipping_documents.exe, 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, LIhMQ.exe, 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, vOqVEnqC.exe, 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://RGpFrRyIJy6rRTyqEb.net	vOqVEnqC.exe, 00000011.00000002.593114242.000000000315F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
27.54.86.236	mail.clipjoint.co.nz	Australia		38719	DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	false

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830622
Start date and time:	2023-03-20 14:50:16 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	shipping_documents.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@25/10@3/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 94% Number of executed functions: 88 Number of non-executed functions: 26
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, conhost.exe
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: shipping_documents.exe

Simulations

Behavior and APIs

Time	Type	Description
14:51:23	API Interceptor	636x Sleep call for process: shipping_documents.exe modified
14:51:33	Task Scheduler	Run new task: vOqVEnqC path: C:\Users\user\AppData\Roaming\vOqVEnqC.exe
14:51:38	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run LIhMQ C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe
14:51:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run LIhMQ C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe
14:51:59	API Interceptor	85x Sleep call for process: vOqVEnqC.exe modified
14:52:01	API Interceptor	268x Sleep call for process: LIhMQ.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
27.54.86.236	sale order.exe	Get hash	malicious	AgentTesla, zgRAT	Browse
	SOA.exe	Get hash	malicious	AgentTesla	Browse
	M70iwGlFIB.exe	Get hash	malicious	AgentTesla, RHADAMANTHYS	Browse
	ZRjKZBWSk7.exe	Get hash	malicious	RHADAMANTHYS	Browse
	PO#198945.exe	Get hash	malicious	AgentTesla	Browse
	Revised Order.exe	Get hash	malicious	AgentTesla	Browse
	Revised Order.exe	Get hash	malicious	AgentTesla	Browse
	AWB 907853880911 PRE-ALRET.xls	Get hash	malicious	AgentTesla	Browse
	file.exe	Get hash	malicious	AgentTesla	Browse
	vbc.exe	Get hash	malicious	AgentTesla	Browse
	PO 1000402812.docx.doc	Get hash	malicious	AgentTesla	Browse
	purchase order.exe	Get hash	malicious	AgentTesla	Browse
	Revised Order.exe	Get hash	malicious	AgentTesla	Browse
	Revised Order.exe	Get hash	malicious	AgentTesla	Browse
	SOA.exe	Get hash	malicious	AgentTesla	Browse
	SOA.exe	Get hash	malicious	AgentTesla	Browse
	statement of account.exe	Get hash	malicious	AgentTesla	Browse
	SOA.exe	Get hash	malicious	AgentTesla	Browse
	SOA.exe	Get hash	malicious	AgentTesla	Browse
	SOA.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.clipjoint.co.nz	sale order.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	27.54.86.236
	SOA.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	M70iwGlFIB.exe	Get hash	malicious	AgentTesla, RHADAMANTHYS	Browse	27.54.86.236
	ZRjKZBWSk7.exe	Get hash	malicious	RHADAMANTHYS	Browse	27.54.86.236
	PO#198945.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	Revised Order.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	Revised Order.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	AWB 907853880911 PRE-ALRET.xls	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	file.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	vbc.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	PO 1000402812.docx.doc	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	purchase order.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	Revised Order.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	Revised Order.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	SOA.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	SOA.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	statement of account.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	SOA.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	SOA.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236
	SOA.exe	Get hash	malicious	AgentTesla	Browse	27.54.86.236

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DREAMSCAPE-AS-APDreamscapeNetworksLimitedAU	8846_0.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	click.wsf	Get hash	malicious	Emotet	Browse	203.26.41.131
	z2H8jaZbYg.elf	Get hash	malicious	Mirai, Moobot	Browse	103.67.234.220
	https://www.starsmiles.com.au/	Get hash	malicious	Unknown	Browse	116.0.23.203
	Form - 16 Mar, 2023.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	https://midcoastsupplies.com.au	Get hash	malicious	Unknown	Browse	27.54.81.161
	https://midcoastsupplies.com.au	Get hash	malicious	Unknown	Browse	27.54.81.161
	#Ud83d#Udce7#U2122 Completed Signed Agreements.shtml	Get hash	malicious	HTMLPhisher	Browse	122.201.127.25
	MBQ24253060297767042_202303161424.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	iMedPub_LTD_4.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	iMedPub_LTD_6.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	INNOVINC.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	Insight_Medical_Publishing_2.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	Insight_Medical_Publishing_1.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	Insight_Medical_Publishing_3.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	Insight_Medical_Publishing_4.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	OMICS_Online_1.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	Insight_Medical_Publishing.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	Omics_Journal.one	Get hash	malicious	Emotet	Browse	203.26.41.131
	OMICS.one	Get hash	malicious	Emotet	Browse	203.26.41.131

Process:	C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping_documents.exe.log

Download File

Process:	C:\Users\user\Desktop\shipping_documents.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vOqVEnqC.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\vOqVEnqC.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\tmp243C.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\vOqVEnqC.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1645
Entropy (8bit):	5.175101949501581
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBgtn:cbhC7ZlNQF/rydbz9I3YODOLNdq34
MD5:	05EA33F3DB79C3F55A592AE8F55D0506
SHA1:	AB8FA39F7158848903BF0AE858C64F43F5201B1C
SHA-256:	1937CC368B67A85D6E2A5CA35515A03024BFD8708B3D259A99198F30EB2497E5
SHA-512:	9F1625115EE2AD779A926A2F583F5EBB3673F428F7AB1CBEB24B4B66502E21CF282633FBB685038D3DF42CD9070BB2B22886CC4926E882AFFE08B46AC178E99F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t

C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp

Download File

Process:	C:\Users\user\Desktop\shipping_documents.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1645
Entropy (8bit):	5.175101949501581
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBgtn:cbhC7ZlNQF/rydbz9I3YODOLNdq34
MD5:	05EA33F3DB79C3F55A592AE8F55D0506
SHA1:	AB8FA39F7158848903BF0AE858C64F43F5201B1C
SHA-256:	1937CC368B67A85D6E2A5CA35515A03024BFD8708B3D259A99198F30EB2497E5
SHA-512:	9F1625115EE2AD779A926A2F583F5EBB3673F428F7AB1CBEB24B4B66502E21CF282633FBB685038D3DF42CD9070BB2B22886CC4926E882AFFE08B46AC178E99F
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t

C:\Users\user\AppData\Local\Temp\tmpE4E1.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1645
Entropy (8bit):	5.175101949501581
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/a7hTlNMFpH/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBgtn:cbhC7ZlNQF/rydbz9I3YODOLNdq34
MD5:	05EA33F3DB79C3F55A592AE8F55D0506
SHA1:	AB8FA39F7158848903BF0AE858C64F43F5201B1C
SHA-256:	1937CC368B67A85D6E2A5CA35515A03024BFD8708B3D259A99198F30EB2497E5
SHA-512:	9F1625115EE2AD779A926A2F583F5EBB3673F428F7AB1CBEB24B4B66502E21CF282633FBB685038D3DF42CD9070BB2B22886CC4926E882AFFE08B46AC178E99F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>t

C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe

Download File

Process:	C:\Users\user\Desktop\shipping_documents.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	986624
Entropy (8bit):	7.440346319495974
Encrypted:	false
SSDEEP:	24576:Jy0QhPJkBhdsXcq1YLTH3p3k4zwCeWdBBuIJC6gE:Jy0QhEvsXb18mOi6p
MD5:	5EC19C18EFF49F78CE02E2CF1831C37D
SHA1:	9D7261D0E2558DD6BD26373C4E2421AD83AF6B19
SHA-256:	EE9C3569905A2A2B5141982928E9205A99170189DAB43F8626102E1A6DDDBE4E
SHA-512:	B7A8A7B81BC259728206CEBC2D7C7530791FAD39F5CC2A4FE0BAD61AE582E3529ED5A2F01A6F48E78724C80132F717E05525DC170C0DA5F2F40153A905CDD688
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W.d..............P.............."... ...@....@.. ....................................@.................................P"..K....@.......................`......."............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................."......H............"......m....=..............................................Z(....8.....(....8.....&~..........~.....b(....8......(....8..........(....&~..........~......0..........8A.......E....Z.../...8U...s......... .....9....&8....s.........8....(....8....s......... .....9....& ....8....s.........8....s.........8.......0..$.......8.......~....o......8....8....8.....0..$.......8....8....8.......~....o......8.....0...........~....o......8....8....8......*..0..........

C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\shipping_documents.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\vOqVEnqC.exe

Download File

Process:	C:\Users\user\Desktop\shipping_documents.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	986624
Entropy (8bit):	7.440346319495974
Encrypted:	false
SSDEEP:	24576:Jy0QhPJkBhdsXcq1YLTH3p3k4zwCeWdBBuIJC6gE:Jy0QhEvsXb18mOi6p
MD5:	5EC19C18EFF49F78CE02E2CF1831C37D
SHA1:	9D7261D0E2558DD6BD26373C4E2421AD83AF6B19
SHA-256:	EE9C3569905A2A2B5141982928E9205A99170189DAB43F8626102E1A6DDDBE4E
SHA-512:	B7A8A7B81BC259728206CEBC2D7C7530791FAD39F5CC2A4FE0BAD61AE582E3529ED5A2F01A6F48E78724C80132F717E05525DC170C0DA5F2F40153A905CDD688
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W.d..............P.............."... ...@....@.. ....................................@.................................P"..K....@.......................`......."............................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................."......H............"......m....=..............................................Z(....8.....(....8.....&~..........~.....b(....8......(....8..........(....&~..........~......0..........8A.......E....Z.../...8U...s......... .....9....&8....s.........8....(....8....s......... .....9....& ....8....s.........8....s.........8.......0..$.......8.......~....o......8....8....8.....0..$.......8....8....8.......~....o......8.....0...........~....o......8....8....8......*..0..........

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\Desktop\shipping_documents.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.694294591169137
Encrypted:	false
SSDEEP:	24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTt8:vDZhyoZWM9rU5fFcP
MD5:	6EB47C1CF858E25486E42440074917F2
SHA1:	6A63F93A95E1AE831C393A97158C526A4FA0FAAE
SHA-256:	9B13A3EA948A1071A81787AAC1930B89E30DF22CE13F8FF751F31B5D83E79FFB
SHA-512:	08437AB32E7E905EB11335E670CDD5D999803390710ED39CBC31A2D3F05868D5D0E5D051CCD7B06A85BB466932F99A220463D27FAC29116D241E8ADAC495FA2F
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....127.0.0.1

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.440346319495974
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	shipping_documents.exe
File size:	986624
MD5:	5ec19c18eff49f78ce02e2cf1831c37d
SHA1:	9d7261d0e2558dd6bd26373c4e2421ad83af6b19
SHA256:	ee9c3569905a2a2b5141982928e9205a99170189dab43f8626102e1a6dddbe4e
SHA512:	b7a8a7b81bc259728206cebc2d7c7530791fad39f5cc2a4fe0bad61ae582e3529ed5a2f01a6f48e78724c80132f717e05525dc170c0da5f2f40153a905cdd688
SSDEEP:	24576:Jy0QhPJkBhdsXcq1YLTH3p3k4zwCeWdBBuIJC6gE:Jy0QhEvsXb18mOi6p
TLSH:	A025AF7D3EAEB9D1F578F671DBD08222E6E39EC3BA16CD4A15C2034C4602757B88225D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....W.d..............P.............."... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4f229e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x641257E1 [Wed Mar 15 23:42:25 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf2250	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x5a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xf6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xf2208	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xf02a4	0xf0400	False	0.7817164330775234	data	7.446877411021773	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xf4000	0x5a8	0x600	False	0.4251302083333333	data	4.099101583815506	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xf6000	0xc	0x200	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xf40a0	0x31c	data
RT_MANIFEST	0xf43bc	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 14:52:17.063770056 CET	49699	587	192.168.2.5	27.54.86.236
Mar 20, 2023 14:52:20.247996092 CET	49699	587	192.168.2.5	27.54.86.236
Mar 20, 2023 14:52:26.253586054 CET	49699	587	192.168.2.5	27.54.86.236
Mar 20, 2023 14:53:09.896615028 CET	49700	587	192.168.2.5	27.54.86.236
Mar 20, 2023 14:53:13.050473928 CET	49700	587	192.168.2.5	27.54.86.236
Mar 20, 2023 14:53:19.051973104 CET	49700	587	192.168.2.5	27.54.86.236
Mar 20, 2023 14:53:19.772902966 CET	49701	587	192.168.2.5	27.54.86.236
Mar 20, 2023 14:53:22.942941904 CET	49701	587	192.168.2.5	27.54.86.236
Mar 20, 2023 14:53:28.943428993 CET	49701	587	192.168.2.5	27.54.86.236

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 14:52:16.981396914 CET	60841	53	192.168.2.5	8.8.8.8
Mar 20, 2023 14:52:17.015774012 CET	53	60841	8.8.8.8	192.168.2.5
Mar 20, 2023 14:53:09.380139112 CET	61893	53	192.168.2.5	8.8.8.8
Mar 20, 2023 14:53:09.426786900 CET	53	61893	8.8.8.8	192.168.2.5
Mar 20, 2023 14:53:19.682809114 CET	60649	53	192.168.2.5	8.8.8.8
Mar 20, 2023 14:53:19.761465073 CET	53	60649	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2023 14:52:16.981396914 CET	192.168.2.5	8.8.8.8	0x79b3	Standard query (0)	mail.clipjoint.co.nz	A (IP address)	IN (0x0001)	false
Mar 20, 2023 14:53:09.380139112 CET	192.168.2.5	8.8.8.8	0x8d08	Standard query (0)	mail.clipjoint.co.nz	A (IP address)	IN (0x0001)	false
Mar 20, 2023 14:53:19.682809114 CET	192.168.2.5	8.8.8.8	0x68a5	Standard query (0)	mail.clipjoint.co.nz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 20, 2023 14:52:17.015774012 CET	8.8.8.8	192.168.2.5	0x79b3	No error (0)	mail.clipjoint.co.nz	27.54.86.236	A (IP address)	IN (0x0001)	false
Mar 20, 2023 14:53:09.426786900 CET	8.8.8.8	192.168.2.5	0x8d08	No error (0)	mail.clipjoint.co.nz	27.54.86.236	A (IP address)	IN (0x0001)	false
Mar 20, 2023 14:53:19.761465073 CET	8.8.8.8	192.168.2.5	0x68a5	No error (0)	mail.clipjoint.co.nz	27.54.86.236	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	14:51:12
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\shipping_documents.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\shipping_documents.exe
Imagebase:	0x480000
File size:	986624 bytes
MD5 hash:	5EC19C18EFF49F78CE02E2CF1831C37D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000000.00000002.353260765.00000000038D9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Target ID:	1
Start time:	14:51:32
Start date:	20/03/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp
Imagebase:	0x12f0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	14:51:32
Start date:	20/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	14:51:32
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\shipping_documents.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x2b0000
File size:	986624 bytes
MD5 hash:	5EC19C18EFF49F78CE02E2CF1831C37D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	4
Start time:	14:51:33
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\shipping_documents.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x320000
File size:	986624 bytes
MD5 hash:	5EC19C18EFF49F78CE02E2CF1831C37D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	5
Start time:	14:51:33
Start date:	20/03/2023
Path:	C:\Users\user\AppData\Roaming\vOqVEnqC.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\vOqVEnqC.exe
Imagebase:	0xbf0000
File size:	986624 bytes
MD5 hash:	5EC19C18EFF49F78CE02E2CF1831C37D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000005.00000002.573256271.0000000004446000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000005.00000002.573256271.0000000004446000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000005.00000002.573256271.0000000004446000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 54%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	6
Start time:	14:51:33
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\shipping_documents.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x760000
File size:	986624 bytes
MD5 hash:	5EC19C18EFF49F78CE02E2CF1831C37D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.590317910.0000000002E49000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_AgentTesla_d3ac2b2f, Description: unknown, Source: 00000006.00000002.579676048.0000000000430000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.590317910.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	7
Start time:	14:51:47
Start date:	20/03/2023
Path:	C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe"
Imagebase:	0xc60000
File size:	986624 bytes
MD5 hash:	5EC19C18EFF49F78CE02E2CF1831C37D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000007.00000002.466893886.00000000076B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 54%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	8
Start time:	14:51:58
Start date:	20/03/2023
Path:	C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe"
Imagebase:	0xb90000
File size:	986624 bytes
MD5 hash:	5EC19C18EFF49F78CE02E2CF1831C37D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Target ID:	11
Start time:	14:52:15
Start date:	20/03/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmpE4E1.tmp
Imagebase:	0x12f0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	12
Start time:	14:52:15
Start date:	20/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	13
Start time:	14:52:16
Start date:	20/03/2023
Path:	C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x10000
File size:	986624 bytes
MD5 hash:	5EC19C18EFF49F78CE02E2CF1831C37D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Target ID:	14
Start time:	14:52:16
Start date:	20/03/2023
Path:	C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xa20000
File size:	986624 bytes
MD5 hash:	5EC19C18EFF49F78CE02E2CF1831C37D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.591331951.0000000002DA1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.591331951.00000000030B0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	15
Start time:	14:52:33
Start date:	20/03/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vOqVEnqC" /XML "C:\Users\user\AppData\Local\Temp\tmp243C.tmp
Imagebase:	0x12f0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	16
Start time:	14:52:33
Start date:	20/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7fcd70000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	17
Start time:	14:52:35
Start date:	20/03/2023
Path:	C:\Users\user\AppData\Roaming\vOqVEnqC.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x9f0000
File size:	986624 bytes
MD5 hash:	5EC19C18EFF49F78CE02E2CF1831C37D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.593114242.000000000315F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.593114242.0000000002E11000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	131
Total number of Limit Nodes:	8

Executed Functions

Function 07467810 Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7dc677bcc947c29ebadaf259b976a84ab78a24f7bcf1d9bb1030efa55596a9
Instruction ID: 1d4a70e857b6086fb0d899bb80fe88c97384975365d9d82d3a9119498399710d
Opcode Fuzzy Hash: 3d7dc677bcc947c29ebadaf259b976a84ab78a24f7bcf1d9bb1030efa55596a9
Instruction Fuzzy Hash: 8DA123B4E112198BDB04CFAAC5855EEFBF2BF89304F14C16AD405BB358E7349A42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 07467802 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845af2addd033dba95cffe819e518bf7da6717a892d06c6bbf770d4e04c824e3
Instruction ID: 17e3a71978aac8eda2a95543c9d8499bbfce60df2d493e12af3b549a8312771d
Opcode Fuzzy Hash: 845af2addd033dba95cffe819e518bf7da6717a892d06c6bbf770d4e04c824e3
Instruction Fuzzy Hash: 5EA114B4E112198BDB04CFA9C5856EEFBF2FF89314F14816AD405BB358E7349A42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0746BD70 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08b2f4eee9d1742ff997e2b5b2c768468691e275c8fc2baf807050e35fa18817
Instruction ID: af9a55c3d5718f4e4608addaa3dda13bfd7eb3b10f463f2b1dec11b66b7fedbe
Opcode Fuzzy Hash: 08b2f4eee9d1742ff997e2b5b2c768468691e275c8fc2baf807050e35fa18817
Instruction Fuzzy Hash: C6612AF0D1A218DBDB08CFA9D5846DDFBB6EF8A300F24A42AD116FB254D7748942CB15

Uniqueness

Uniqueness Score: -1.00%

Function 07467C97 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efe32b5055787384d87ecf7f04b8266b0f2ca7c019a15fefabaae0b0af0b0b1b
Instruction ID: 5109e946f730d23a6b6339667934aa30d2b9c6c7483808ac91f47ba8f8857d4e
Opcode Fuzzy Hash: efe32b5055787384d87ecf7f04b8266b0f2ca7c019a15fefabaae0b0af0b0b1b
Instruction Fuzzy Hash: BE5197B0E102198FCB05CFA9D484AEEFBF2AF89314F14C866D524B7345D7349A468FA1

Uniqueness

Uniqueness Score: -1.00%

Function 07467CA8 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0f340d5a4e6d30b4501b8c0670dec625fbeae7cb116f0adcee08825959ed9cb
Instruction ID: 1339852238657c8642afe01a740c9b582704d3a35589da31c040e00166ddb2fc
Opcode Fuzzy Hash: d0f340d5a4e6d30b4501b8c0670dec625fbeae7cb116f0adcee08825959ed9cb
Instruction Fuzzy Hash: 05516BB4E112198FDB04CFA9D484AEEFBF2BB89314F14C42AD524B7345D7349A468FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0746F728 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f822e56dbdfdca4f103f629b8e2af32a20aed85ea6e0dd849e8ad6ef3b72ac10
Instruction ID: e6ed1e62f7add4deccbd699f703a7fef4eee7cdc53100ecc2c8632a864e76c58
Opcode Fuzzy Hash: f822e56dbdfdca4f103f629b8e2af32a20aed85ea6e0dd849e8ad6ef3b72ac10
Instruction Fuzzy Hash: 9E3116B0D19219CFCB14CFA5E8487EDBAF5BB4A302F10A46AE485B3251C734594ACF66

Uniqueness

Uniqueness Score: -1.00%

Function 07460006 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cf0ec4415767f8e81679e77e861a449d7a9ce28bc7d63b45c01f9a8156702f2
Instruction ID: e856e3781de979382b12caf9ece659356dc3a6edc7f8c691249ba18d3ca16e4c
Opcode Fuzzy Hash: 2cf0ec4415767f8e81679e77e861a449d7a9ce28bc7d63b45c01f9a8156702f2
Instruction Fuzzy Hash: F1316DB1D056548FD709CFA6C9442CABFF3EF85350F19C1AAC405A6265DA344945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07460040 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b27962eb138ec77d7bfc9e488cd85bcb24a1a4253708dd746928a7996485520
Instruction ID: cdf9f789f6409d3e88748b8cbdfd10b3da65fb23d1c21fc71c294670860861a7
Opcode Fuzzy Hash: 9b27962eb138ec77d7bfc9e488cd85bcb24a1a4253708dd746928a7996485520
Instruction Fuzzy Hash: 1E21F971E016188BDB18CFAAD9446DEBBB7EFC9310F14C1AAE409A6364DB345A85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00BCBA41 Relevance: 6.1, APIs: 4, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00BCBAB0
GetCurrentThread.KERNEL32 ref: 00BCBAED
GetCurrentProcess.KERNEL32 ref: 00BCBB2A
GetCurrentThreadId.KERNEL32 ref: 00BCBB83

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 54a96ce4d23d7021ee76c141645daa660805620b71e02515707c1664cc1d0d64
Instruction ID: fc9d4998f5c4f3fae41a2b6dd06496edbe72044b0ceae71a468d76fa6832ff7f
Opcode Fuzzy Hash: 54a96ce4d23d7021ee76c141645daa660805620b71e02515707c1664cc1d0d64
Instruction Fuzzy Hash: 4B517AB19002498FDB00CFAAD988BDEBFF0EF49304F2484AEE059B7251C7745944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00BCBA50 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00BCBAB0
GetCurrentThread.KERNEL32 ref: 00BCBAED
GetCurrentProcess.KERNEL32 ref: 00BCBB2A
GetCurrentThreadId.KERNEL32 ref: 00BCBB83

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 00375885efeb3c3c5ed01b15a5289166156e1d367bd3dea6ab4feafb0b1093e6
Instruction ID: 453e461e9eaa4fd6925c4c64540c2dc605869a106139b32fd9126ca979a1b134
Opcode Fuzzy Hash: 00375885efeb3c3c5ed01b15a5289166156e1d367bd3dea6ab4feafb0b1093e6
Instruction Fuzzy Hash: 375147B19002498FDB14CFAAD588BDEBFF4EF48314F2484A9E019B7250CB746944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00BC9750 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00BC9996

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2487a3f46b26478be5da2835b94c4386ef0ad8d940eae52ee28e0b6c06568ef8
Instruction ID: cddda0289ffb60281e3fed53fe44bc74dd8a2a56d0bd5f909178c9a7a9168d3c
Opcode Fuzzy Hash: 2487a3f46b26478be5da2835b94c4386ef0ad8d940eae52ee28e0b6c06568ef8
Instruction Fuzzy Hash: 53713670A00B058FE724DF2AD444B5ABBF1FF88340F10896EE48ADBA50DB75E905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0746D6B8 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 0746D80B

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 94d2208f35192c52665b7020a9c21267b3d6f10b1476fe54f17df819a7fc95e1
Instruction ID: abfd401b30f1b114aedc68daf8d7ae3288b8cafb68617c1450271cb4485d9bfc
Opcode Fuzzy Hash: 94d2208f35192c52665b7020a9c21267b3d6f10b1476fe54f17df819a7fc95e1
Instruction Fuzzy Hash: E65106B1E003199FDF14DF99C884BDEBBB5BF48310F1484AAE809A7210DB755A89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0746DD78 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0746DE05

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b1f581a3a84da3d4bff44cc195e0f8fb8e72a1e3b91bba033e6e0a3e66737334
Instruction ID: 40e4d1300422808dab5cff01b612c91e5f89ce3987abf9d3e8dae26c5fbf3444
Opcode Fuzzy Hash: b1f581a3a84da3d4bff44cc195e0f8fb8e72a1e3b91bba033e6e0a3e66737334
Instruction Fuzzy Hash: 5621E0B5E002599FCB10CF9AC984BDEBBF4FB48310F10842AE919A7750D778A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BCBC70 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BCBCFF

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 4418f4e3348c3702a2ca7cff0a06ab4e98a8e7e472fe0b2ab6574d00f9f8a681
Instruction ID: 34cde57dad5a96839831ba1c718333590a4979d7c46495ac0cca24238a441bd3
Opcode Fuzzy Hash: 4418f4e3348c3702a2ca7cff0a06ab4e98a8e7e472fe0b2ab6574d00f9f8a681
Instruction Fuzzy Hash: 3521D2B59002099FDB10CFA9D984AEEBBF4FF48324F14846AE815A7210C378A945DF65

Uniqueness

Uniqueness Score: -1.00%

Function 00BCBC78 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00BCBCFF

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: aa90fde762279e839657f0ef9e6fb66f3757e28fd888833cf85b52a490a55449
Instruction ID: abe2f3cb95e9c79bd55c025c18e511b0a41e1cfb0b0656ca9dc1bd025566b36c
Opcode Fuzzy Hash: aa90fde762279e839657f0ef9e6fb66f3757e28fd888833cf85b52a490a55449
Instruction Fuzzy Hash: CB21E4B59002099FDB10CF9AD984ADEBBF4EB48324F14842AE815A7310D378A944DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0746DAE8 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0746DB67

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 245aae1d6fb728ae01e7a090c22acf4f5d4f4e72358c698889f5914790d3bae6
Instruction ID: b97f25bf093456206cbf7700536d7042fad8835060411176fc4ab77ee37106ff
Opcode Fuzzy Hash: 245aae1d6fb728ae01e7a090c22acf4f5d4f4e72358c698889f5914790d3bae6
Instruction Fuzzy Hash: E221E2B5E00259DFCB10CF9AD984ADEBBF4FB48320F10842AE918A7250D378A544DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0746DA28 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0746DA9F

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 09564f8240734a6d9ff9c581c7a3f0d4eb6990c3b14b42875dadce3f898a78cc
Instruction ID: d923332bc911ef5bb14da9f4b71864d870420915692ddfbc9b6256c8189b0691
Opcode Fuzzy Hash: 09564f8240734a6d9ff9c581c7a3f0d4eb6990c3b14b42875dadce3f898a78cc
Instruction Fuzzy Hash: 0921F7B1E0461A9FCB10CF9AC9847EEFBF4BB48710F14812AD418B7740D778A9448FA5

Uniqueness

Uniqueness Score: -1.00%

Function 07466918 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07466993

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0247ec962a9b76e50f0c3adc86524005995a2a435568408fe139847bdaad6a6a
Instruction ID: 568868b8ed697ba2f7b43cb132e89981b1b36f9ef9403812af29a69657c4a305
Opcode Fuzzy Hash: 0247ec962a9b76e50f0c3adc86524005995a2a435568408fe139847bdaad6a6a
Instruction Fuzzy Hash: 072106B6D002099FCB10CF9AC984BDEBBF4FB48320F14842AE859A7240D378A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07466920 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07466993

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e2ab26bf0fc95b377b318d425a81b6b3e7726dcd30fffc86e94bae56741fdc12
Instruction ID: 6c4393ca910a7eba95cc0bc9c05e2db2f420e5ae02b3ad977bfb726b841b9437
Opcode Fuzzy Hash: e2ab26bf0fc95b377b318d425a81b6b3e7726dcd30fffc86e94bae56741fdc12
Instruction Fuzzy Hash: 9C2117B5D002099FCB10CF9AC984BDEFBF4FB48320F10842AE858A7240D378A544CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 00BC8CF8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00BC9A11,00000800,00000000,00000000), ref: 00BC9C22

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7f8008e64ba4968c6b0943c954e98230cd875009b0167678a4519dc20015c042
Instruction ID: b6c623286804a99caa0eda219d6612e1a3ea91afc2e059bc853c315fb38fa099
Opcode Fuzzy Hash: 7f8008e64ba4968c6b0943c954e98230cd875009b0167678a4519dc20015c042
Instruction Fuzzy Hash: 5511D3B69002499FDB10CF9AD588BDEBBF4EB48710F14846ED415A7600C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BC9BB0 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00BC9A11,00000800,00000000,00000000), ref: 00BC9C22

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 38e8984286d2c45405efcc7b6bda438e40ccee351a04c0d822a97e2f6c1de27c
Instruction ID: 35b4be643e2bbbc0c05dc1e8d85a896ab2d3f931a54a7b3c6efbccf849941160
Opcode Fuzzy Hash: 38e8984286d2c45405efcc7b6bda438e40ccee351a04c0d822a97e2f6c1de27c
Instruction Fuzzy Hash: 2F21F4B6D002098FDB14CF9AD844ADEBBF4EB88320F11856ED415A7650C3789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0746DBB8 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0746DC23

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ddc6a238f396d4e0df7478fd72fcf8bd122ce1db376f337efe0da631fab7cc18
Instruction ID: 9565d8e5b7e79be52c5803f30c58964e9521325d8d83a02e3119c531bee62dfb
Opcode Fuzzy Hash: ddc6a238f396d4e0df7478fd72fcf8bd122ce1db376f337efe0da631fab7cc18
Instruction Fuzzy Hash: 8011D2B59002499FCB10CF9AD984BDEBBF4EB48320F108419E519A7250C775A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0746A848 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0746E875

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: beda22b3054cc349dac4010344df5f4898925a298df433a6f1d35d19abfa0665
Instruction ID: 3b785f784622b5a497ea0ec4e5685f1c279ed6f5cbb861b0f10280dbbc5faf5b
Opcode Fuzzy Hash: beda22b3054cc349dac4010344df5f4898925a298df433a6f1d35d19abfa0665
Instruction Fuzzy Hash: 7E11F5B9800259DFDB10CF9AC588BDEBBF8FB48724F10886AE455B7600C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BC9930 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00BC9996

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d33c8a7c36440fff5252d66980fde0cd4b38df4644958570bc0df6e4a4273de6
Instruction ID: e518bd5dfacd8e3e988470ff6fec6fcdcb9a42b2cadec1b735b4810250535f89
Opcode Fuzzy Hash: d33c8a7c36440fff5252d66980fde0cd4b38df4644958570bc0df6e4a4273de6
Instruction Fuzzy Hash: 1311FDB6C002498FDB10CF9AC448BDEBBF4EB88320F10846ED469B7600C3B9A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0746DF30 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0746DF8F

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 3b11f3ad94fc19661b17a175da9111b6b7b4d1a52b8e3f5c4befc48ac031cdf7
Instruction ID: 5d525fb6427d8137d0426889dc29e584c0673bb5bce7394cd2c9306c6a303589
Opcode Fuzzy Hash: 3b11f3ad94fc19661b17a175da9111b6b7b4d1a52b8e3f5c4befc48ac031cdf7
Instruction Fuzzy Hash: C11115B5D002498FCB10CF9AC588BDEBBF4EB48324F10841AD419B7340C775A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.348817597.0000000000B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b2d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628eb9ff981519d0a556d97dc0930aa18a243fef7a244e8db7716ec001fd6e6d
Instruction ID: b3e0e7b8ebbedfcd0488f0b848c847f94ae52a148a5ca4df12ba0476a24ad4b6
Opcode Fuzzy Hash: 628eb9ff981519d0a556d97dc0930aa18a243fef7a244e8db7716ec001fd6e6d
Instruction Fuzzy Hash: 1421F5B1504240DFDB05EF14E9C0B16BFA5FB98324F24C6A9E8494B346C336E856D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.348817597.0000000000B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b2d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7808c12c6ecbdbfb4ec8c606c1871d4d0e223f308e57d3f76413e6d1f1c485
Instruction ID: db837b25a7791144223e3d43bd28ef228ca8747f8aa46f7cded07ed5a393b74a
Opcode Fuzzy Hash: 0c7808c12c6ecbdbfb4ec8c606c1871d4d0e223f308e57d3f76413e6d1f1c485
Instruction Fuzzy Hash: 85212871504240DFDB05DF14E9C0B16BFA5FBA4324F24C6A9D8090B216C376E846D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.348864725.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8cf9f8fb44c38ca94517f24602bda5791e49c1841a04848474a302a969410df
Instruction ID: fc4dbc44a2960ab59d71217952693c54764f33441fceab09f0ea3cd39cbd5d0d
Opcode Fuzzy Hash: b8cf9f8fb44c38ca94517f24602bda5791e49c1841a04848474a302a969410df
Instruction Fuzzy Hash: 6A21F275604240EFDB05DF14E9C0B26BBA5FB84314F34CAADE8494B246C736E846DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.348864725.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c013226473989a5e8f50352966e7b59b8288f738d044df8ff84e8a06fea660b
Instruction ID: ca7b0303343947cfeb824808b74f83c45da31d961d68d5f8ebc7088a495a8265
Opcode Fuzzy Hash: 9c013226473989a5e8f50352966e7b59b8288f738d044df8ff84e8a06fea660b
Instruction Fuzzy Hash: 3D213771504240DFCB18CF14E4D0B16BBA5FB84B14F30CAADD84A4B246C336D847DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.348864725.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebce3902383efd8bbd13317fa474f5b1254a5155c7463a4c49a8713382c0a0fe
Instruction ID: ccd2434b278ed4342f0212d176fdbfedb5b7c0ee57d5901a38a80f4e105350e9
Opcode Fuzzy Hash: ebce3902383efd8bbd13317fa474f5b1254a5155c7463a4c49a8713382c0a0fe
Instruction Fuzzy Hash: 6D2192755083809FCB06CF24D994B11BFB1EB46314F28C5EAD8458F257C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.348817597.0000000000B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b2d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction ID: 34a45314dee535ca8113dbe95fd1981995bbf7d29d74992dee527f3aa4ac0886
Opcode Fuzzy Hash: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction Fuzzy Hash: 2411B176504280CFDB16DF10D9C4B16BFB1FB94324F24C6A9D8494B616C33AE85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B2D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.348817597.0000000000B2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b2d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction ID: fa6c1e7868127430a45fa2e94a0950a28565528de783e1992c2a7c4a680980cb
Opcode Fuzzy Hash: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction Fuzzy Hash: C211D376904280CFDB16CF14D5C4B16BFB1FB94324F24C6A9D8490B616C37AD856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B3D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.348864725.0000000000B3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f825cc49a36603e58b05d30dbcded4ff69a659c0c942629433790640a090c2f4
Instruction ID: 17544abd754128b3118eded795a3d3de2986edbb8b3a2d606d8472c0afaa1aab
Opcode Fuzzy Hash: f825cc49a36603e58b05d30dbcded4ff69a659c0c942629433790640a090c2f4
Instruction Fuzzy Hash: 84119D75904280DFDB16CF14D9C4B16FBB1FB84324F28C6ADD8494B656C33AD85ACB61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 074631A0 Relevance: 3.9, Strings: 3, Instructions: 173COMMON

Download Yara Rule

Strings

D,K, xrefs: 074632A0
D,K, xrefs: 074632A7
D,K, xrefs: 074632BE

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: D,K$D,K$D,K
API String ID: 0-963307994
Opcode ID: 584f5429d4eb4b65cc3ab72ecb25e22162393d6af7cfe45a905169f0934d2b32
Instruction ID: 7728eb863947db9b746c2a182631a191910fea916eccf4ed9be678f98b6373e4
Opcode Fuzzy Hash: 584f5429d4eb4b65cc3ab72ecb25e22162393d6af7cfe45a905169f0934d2b32
Instruction Fuzzy Hash: AB71F4B4E15249CFCB08CFA9C9854DEFBF2FB89310F24982AD405BB214D7349A428F65

Uniqueness

Uniqueness Score: -1.00%

Function 07463190 Relevance: 3.9, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

D,K, xrefs: 074632A0
D,K, xrefs: 074632A7
D,K, xrefs: 074632BE

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: D,K$D,K$D,K
API String ID: 0-963307994
Opcode ID: 9b820a6d7358d5988d8249cfbaec2d2982deda3afb0bfb352e91cc12e9bf3aff
Instruction ID: 725332dc2484fa8ac648d2472172bd6402f1928ff388b0dc83757b6407d638b2
Opcode Fuzzy Hash: 9b820a6d7358d5988d8249cfbaec2d2982deda3afb0bfb352e91cc12e9bf3aff
Instruction Fuzzy Hash: 3071D4B4E156498FCB08CFA9C5855DEFBF2FF89310F24986AD405B7214D2349A428F65

Uniqueness

Uniqueness Score: -1.00%

Function 07462FB8 Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

RBO, xrefs: 07463060
RBO, xrefs: 07463059

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: RBO$RBO
API String ID: 0-2542440281
Opcode ID: 41586c59da463b7f19c508fc3b15fb50c387bb5c10cca0dc16c827569fc9aca4
Instruction ID: 4fbd4ea4aa3c3b96b0b9db16d1b98487edaccf6f8b55814ce0cad5ad90c53a6a
Opcode Fuzzy Hash: 41586c59da463b7f19c508fc3b15fb50c387bb5c10cca0dc16c827569fc9aca4
Instruction Fuzzy Hash: 0041D2B0E1060ADBCB48DFAAC4855EEFBF2BF88300F14C46AC519A7248D7349A46CF55

Uniqueness

Uniqueness Score: -1.00%

Function 07462FA8 Relevance: 2.6, Strings: 2, Instructions: 92COMMON

Download Yara Rule

Strings

RBO, xrefs: 07463060
RBO, xrefs: 07463059

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: RBO$RBO
API String ID: 0-2542440281
Opcode ID: a992a90f4a842b66b3ff0333dc579d37303da6d8a23a3fec7daf88b40d18ea81
Instruction ID: b2868e16d538dc55755dae4d1605029c5f1c536e029a99a9c4062bd50b8383a7
Opcode Fuzzy Hash: a992a90f4a842b66b3ff0333dc579d37303da6d8a23a3fec7daf88b40d18ea81
Instruction Fuzzy Hash: D041E2B0E1064ADBCB08DFAAC4845EEFBF2FF89350F24C46AC515A7248D7349A468F55

Uniqueness

Uniqueness Score: -1.00%

Function 0746BA80 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

:-Dn, xrefs: 0746BBA5

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: :-Dn
API String ID: 0-2958611508
Opcode ID: 2a9fc920d5559ff3d7e0c5677f53b6a3ace08a3b27c110ae6a37c2c1684aac01
Instruction ID: 8482230d6fe9bab183b571cb41f0332517233288672ab7d204579e82b3d4224b
Opcode Fuzzy Hash: 2a9fc920d5559ff3d7e0c5677f53b6a3ace08a3b27c110ae6a37c2c1684aac01
Instruction Fuzzy Hash: 7D7138B4E1520ACFCB05CFA6D5855EEBBB2EF89300F24942AD015F7248D7749942CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0746C018 Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

d, xrefs: 0746C1CC

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: ca8f4c16b5bf639d3e7a7060e3d015b7a691276170fba43506d5455d8749958b
Instruction ID: a44714402a72e29c980011276af454dc62554d24a5f1bb3397b9ae4b68877cee
Opcode Fuzzy Hash: ca8f4c16b5bf639d3e7a7060e3d015b7a691276170fba43506d5455d8749958b
Instruction Fuzzy Hash: 96612BB5E5462A8BDB28CF66C9447EAF7B2BFC9300F0085B6D509A7614EB305A818F51

Uniqueness

Uniqueness Score: -1.00%

Function 074613A0 Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

gpRR, xrefs: 074613EE

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: gpRR
API String ID: 0-3735844856
Opcode ID: c8d686cdd1c41c637f9dc0404bdcddfc57be3e99dab2138673d8f6d48578bb39
Instruction ID: b99061d29950c756ee0dbdd6966f2488519662bdd03e7609a1f0daa546deca3f
Opcode Fuzzy Hash: c8d686cdd1c41c637f9dc0404bdcddfc57be3e99dab2138673d8f6d48578bb39
Instruction Fuzzy Hash: 534109B4E1561A8FCB04CF99C5849EEFBF1BB89310F14D52AD416A7264D3349A42CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07461392 Relevance: 1.4, Strings: 1, Instructions: 110COMMON

Download Yara Rule

Strings

gpRR, xrefs: 074613EE

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: gpRR
API String ID: 0-3735844856
Opcode ID: c437ced91d3adbb7e2506955c934c35aa1f8f9f344284ef014138acfd29725db
Instruction ID: cab4e9e920642a61da22881607fe9e11f3c2cf915c33f9c2da271ede2a17387f
Opcode Fuzzy Hash: c437ced91d3adbb7e2506955c934c35aa1f8f9f344284ef014138acfd29725db
Instruction Fuzzy Hash: 414129B4E152198BCB04CF99C9845EEFBF1BB89310F14D52AD416B7364D3349A42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07463430 Relevance: 1.4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

Strings

3_<, xrefs: 07463501

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: 3_<
API String ID: 0-1201742200
Opcode ID: af9ee85cfd1a060c9099f5f6ea245ec22503f5ead5f24562efab67fc657bbfc2
Instruction ID: 03de469c3946c6f845d6a6a3b0e87c4cdf68e6121da06dc518e42c058c94e204
Opcode Fuzzy Hash: af9ee85cfd1a060c9099f5f6ea245ec22503f5ead5f24562efab67fc657bbfc2
Instruction Fuzzy Hash: 7E41F8B0E1525ADBDB04CFAAC9845EEFBF2AF89300F24C46AC905B7354D7349A418B95

Uniqueness

Uniqueness Score: -1.00%

Function 074641C8 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

SohL, xrefs: 0746430D

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: SohL
API String ID: 0-1765351257
Opcode ID: f54ed83868be3605e542689a501c5d9bcfe0d9a114425ec83bdd5ee09d15ca63
Instruction ID: 9568ae1ac6f35db340d65b1eae09c19384b3a4e2cf97a305c161e15c00a2c488
Opcode Fuzzy Hash: f54ed83868be3605e542689a501c5d9bcfe0d9a114425ec83bdd5ee09d15ca63
Instruction Fuzzy Hash: 4D4140B5E116188BDB18CF6B8D4529EFBF3BFC8300F14C1BA850DA6254DB3419868E11

Uniqueness

Uniqueness Score: -1.00%

Function 07463420 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

3_<, xrefs: 07463501

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: 3_<
API String ID: 0-1201742200
Opcode ID: d62b50b3db07117dd1adf8edad8a875e063c3e30e5232a2f2c796148bf54668d
Instruction ID: 6c549ef8db2007e96ce602414afa27a47550a9a7e72216a31317a07647477029
Opcode Fuzzy Hash: d62b50b3db07117dd1adf8edad8a875e063c3e30e5232a2f2c796148bf54668d
Instruction Fuzzy Hash: 9E4139B0E1524ADBCB04CFA9C9804EEFBF2EF89310F24C46AC905B7354D7349A428B95

Uniqueness

Uniqueness Score: -1.00%

Function 074641C3 Relevance: 1.3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

Strings

SohL, xrefs: 0746430D

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID: SohL
API String ID: 0-1765351257
Opcode ID: 446bf0de0098392b497d357f0401797129b0351ba3c8e101fd170cfcc4e86a12
Instruction ID: 4296e867a9843e0cd808430196f730500e6e2c4afc20f6d4249687eebb9fc34d
Opcode Fuzzy Hash: 446bf0de0098392b497d357f0401797129b0351ba3c8e101fd170cfcc4e86a12
Instruction Fuzzy Hash: D5414EB5E016588BEB18CF6B8D4578EFAF3BFC8300F14C1BA950CA6254EB3419858F11

Uniqueness

Uniqueness Score: -1.00%

Function 00BCE7F8 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a67a1a2b5029e5cd6ab82c9d7e42857f5fa67ea83271aac5a48f8f294e46bf0c
Instruction ID: 2c9413210a4c5ad34993a2f1daf893a1be98256d9d52a935a1c9c5b069d21b6f
Opcode Fuzzy Hash: a67a1a2b5029e5cd6ab82c9d7e42857f5fa67ea83271aac5a48f8f294e46bf0c
Instruction Fuzzy Hash: 6F12A6F1491F46CBE732CF65EE981893BA1B745328F90430AD2651BAF1DBB8114ACF58

Uniqueness

Uniqueness Score: -1.00%

Function 00BCC504 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6161d3a80f27d5b8385d34bd3e3f67213168b443179a90d74a0cacafd05a4b1b
Instruction ID: 8eaf7759abee5d55a15379c295ec05aa584de22431e44c9ff161f2388fbb10db
Opcode Fuzzy Hash: 6161d3a80f27d5b8385d34bd3e3f67213168b443179a90d74a0cacafd05a4b1b
Instruction Fuzzy Hash: 4EA15D36E002198FCF15DFA5C844A9EBBF2FF94300B1585BAE915AB221EB71E945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00BCE7E8 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.349222944.0000000000BC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bc0000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8afd8830a7b0721d0ca32bed73ac41f795d635144c4c8d589a8a7245bc4a2092
Instruction ID: 07220d54cb8522cdd8dba02f7166635b27195f6e5c19959ec2f35d41e0034c48
Opcode Fuzzy Hash: 8afd8830a7b0721d0ca32bed73ac41f795d635144c4c8d589a8a7245bc4a2092
Instruction Fuzzy Hash: FAC11AB1891F46CBE722DF65EE981893BB1BB45324F51430AD1616B6F0DFB8204ACF58

Uniqueness

Uniqueness Score: -1.00%

Function 07469F18 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c48f09015071e62cef324350c6e0d9bb15bc36029d87098b8b7ebf7f4806c85
Instruction ID: 55e3667574d3ca3a6bb4a6ef2f04c22da98c342978cfc972cafba8b7b842788d
Opcode Fuzzy Hash: 1c48f09015071e62cef324350c6e0d9bb15bc36029d87098b8b7ebf7f4806c85
Instruction Fuzzy Hash: F98106B4E11619CFCB18CF69D984ADEFBB2BF89300F1084AAD509A7360DB309A41CF11

Uniqueness

Uniqueness Score: -1.00%

Function 07461E38 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c541fc79082e4221688005826af275928de7faece2ed10f1c52aa07e67a5242
Instruction ID: 10e9176ba109ba5b3308cb60f66c836ce14eb790de48eb7525c039f06073c25e
Opcode Fuzzy Hash: 6c541fc79082e4221688005826af275928de7faece2ed10f1c52aa07e67a5242
Instruction Fuzzy Hash: BA71B074E11219DFCB08CFA9D58499EFBF1FF89310F148956E419AB220D734AA41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07461E28 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea1808486a7e673dcc7e4f63876f628ff64253c7658710462dee4c58bcc1d253
Instruction ID: 35c826f37d41bba9835020701bef16c2b644f425f83a52650856cb18c93f4c54
Opcode Fuzzy Hash: ea1808486a7e673dcc7e4f63876f628ff64253c7658710462dee4c58bcc1d253
Instruction Fuzzy Hash: 1771D174E11209DFCB48CFA9D58499EFBF1FF89310F14896AE519AB220D734AA41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 07466F24 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4a3edbb8c0fbf3f587bb713b1d4211b682e7481d063166633d69d6f10fa0266
Instruction ID: 997c0c8b9b7f9ac0ee4e3a0929a3ec67476efed02003dc27655c3486944364d6
Opcode Fuzzy Hash: e4a3edbb8c0fbf3f587bb713b1d4211b682e7481d063166633d69d6f10fa0266
Instruction Fuzzy Hash: 742175B5E116148BDB18CFAAD9816DEFBF3EBC8310F14C176D504A7354D73046028B52

Uniqueness

Uniqueness Score: -1.00%

Function 07466F60 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4904da8cc168778cc0b775de73321009cce2dffae20206166b45e411c3e46340
Instruction ID: d3110ba7d928978b45a83ddc1e24611557a17462a946882308da6ecb694992c4
Opcode Fuzzy Hash: 4904da8cc168778cc0b775de73321009cce2dffae20206166b45e411c3e46340
Instruction Fuzzy Hash: C52147B1E116198BDB18CFAAE9406DEFBF7BFC8310F14C13AD408A7254EB305A018B91

Uniqueness

Uniqueness Score: -1.00%

Function 07468BE0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd450f3e5e27ff252bb5153fa4a2af3cc0606b09ea7cc70125399dd2f348f403
Instruction ID: 693d2dca633135fca4713e0d724fdfa72e7df4ba3f261e17875d31d703fce6fe
Opcode Fuzzy Hash: cd450f3e5e27ff252bb5153fa4a2af3cc0606b09ea7cc70125399dd2f348f403
Instruction Fuzzy Hash: 032127B1E116198BEB08CFAAD9446DEFBF7AFC9210F14C03AD508B7254DB305A418B51

Uniqueness

Uniqueness Score: -1.00%

Function 07467F28 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7476e15de27040d7281c543ecf57ea2d854bc95332f7a47726b119981d01e43
Instruction ID: 247930adca613b46a16c7de3b8243015e7b7c704e9c31a8f949187dce86193f3
Opcode Fuzzy Hash: b7476e15de27040d7281c543ecf57ea2d854bc95332f7a47726b119981d01e43
Instruction Fuzzy Hash: 0C1129B1E116199BEB18CFAAD9446EEFBF7BBC8300F14C07AD508A7254DB305A418F51

Uniqueness

Uniqueness Score: -1.00%

Function 07468BCF Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 628b06c637de674dd301e81ca9021dac61a795a689ee511ef4970b13fd69d78d
Instruction ID: 38de72a0897dc3325bbf02553b340fb5646f57fc8292f7a3352dba4bcda14ee7
Opcode Fuzzy Hash: 628b06c637de674dd301e81ca9021dac61a795a689ee511ef4970b13fd69d78d
Instruction Fuzzy Hash: 85210BB0E116599FDB08CFAAD94069EFBF7AFC9200F18C07AD408AA255DB3059458B51

Uniqueness

Uniqueness Score: -1.00%

Function 07463610 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2ab3b1d9d2a9f24f8e133d5bafb87c6d277369c2df2ec0e7034529aa238f85
Instruction ID: 266301ab3efc7e3e78cecc5b26217f7b6e2677a84e30a0fcde305bb749450b90
Opcode Fuzzy Hash: 6c2ab3b1d9d2a9f24f8e133d5bafb87c6d277369c2df2ec0e7034529aa238f85
Instruction Fuzzy Hash: 6D11EFB1E116589BEB18CFABD9446DEFBF7AFC8300F14C076C908A6264EB3406568F51

Uniqueness

Uniqueness Score: -1.00%

Function 07467F18 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5dc04b8df3a9952ba3a072f87104028635f137ee29ad9cc59ff401e9d4c179
Instruction ID: eeca28bdf674245786a0b48be88cdab9cfff8a30d8a97e83a955f6c940727d28
Opcode Fuzzy Hash: 5e5dc04b8df3a9952ba3a072f87104028635f137ee29ad9cc59ff401e9d4c179
Instruction Fuzzy Hash: 1E112CB1E116199BEB58CF6AD94169EFBF7AFC8300F14C07AD408AA255DB305A428F51

Uniqueness

Uniqueness Score: -1.00%

Function 07463600 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.367621183.0000000007460000.00000040.00000800.00020000.00000000.sdmp, Offset: 07460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7460000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c76544fd57796fde754cfde3cfd4ceaac11fc0570df6c54f61098a473bf7821a
Instruction ID: be156b8dde67645048d5ce61a84e20c18ce0e6d2cae2a8d1e82e42e8834b9854
Opcode Fuzzy Hash: c76544fd57796fde754cfde3cfd4ceaac11fc0570df6c54f61098a473bf7821a
Instruction Fuzzy Hash: 0811BFB1E116549BEB58CFABCD4429EFBF3AFC8300F18C476C418A6264EB3445468F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vOqVEnqC.exePID: 1248, Parent PID: 1084COMMON

Execution Graph

Execution Coverage:	11.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	131
Total number of Limit Nodes:	6

Executed Functions

Function 02F3BA41 Relevance: 6.1, APIs: 4, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02F3BAB0
GetCurrentThread.KERNEL32 ref: 02F3BAED
GetCurrentProcess.KERNEL32 ref: 02F3BB2A
GetCurrentThreadId.KERNEL32 ref: 02F3BB83

Memory Dump Source

Source File: 00000005.00000002.510628436.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f30000_vOqVEnqC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: bb8990023911880b380e68148448f50be40f774849e58d92c84881b3db212712
Instruction ID: b91aa8e7b8b867acc1dc54e5d852d95915c08f092882b2c437a172c3313f94c5
Opcode Fuzzy Hash: bb8990023911880b380e68148448f50be40f774849e58d92c84881b3db212712
Instruction Fuzzy Hash: 585147B0D012498FDB10CFAAD588BDEBBF0BF88308F24846AD559A7350C774A984CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02F3BA50 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02F3BAB0
GetCurrentThread.KERNEL32 ref: 02F3BAED
GetCurrentProcess.KERNEL32 ref: 02F3BB2A
GetCurrentThreadId.KERNEL32 ref: 02F3BB83

Memory Dump Source

Source File: 00000005.00000002.510628436.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f30000_vOqVEnqC.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 0d6134ced12c9cb99e5aefbc246be38de0cbab2aef4b4065a9e3ee5f48eb1fbb
Instruction ID: bfa4a6eba428faed502132123dd755b625d892c6c0d1b9378c3d8dab610e80dd
Opcode Fuzzy Hash: 0d6134ced12c9cb99e5aefbc246be38de0cbab2aef4b4065a9e3ee5f48eb1fbb
Instruction Fuzzy Hash: 285146B0D012498FDB14CFAAD588BDEBBF0BF88308F20846AE559B7750C7749984CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02F39750 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02F39996

Memory Dump Source

Source File: 00000005.00000002.510628436.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f30000_vOqVEnqC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 16770a66aefce6bd771195c832e8d276360c3934da1cacf7370d04e857285fe4
Instruction ID: ef7016cf3584c9b104eb4d758649900e081276a37b4f1c9ee1cffc2c2c1d493d
Opcode Fuzzy Hash: 16770a66aefce6bd771195c832e8d276360c3934da1cacf7370d04e857285fe4
Instruction Fuzzy Hash: 55711370A01B059FD725DF2AC444B9ABBF1BF88384F00892DD58ADBA50D7B5E845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0791D628 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 0791D77B

Memory Dump Source

Source File: 00000005.00000002.578954850.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7910000_vOqVEnqC.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fd8a3b1899cc61abbe49a96bb66655a7c7e92559104006d93a91f39cfb6c5c3a
Instruction ID: 4e34e1f6fb30046fb5bda921e1ae201060b0998cf8429260a7825d2d8a6dc631
Opcode Fuzzy Hash: fd8a3b1899cc61abbe49a96bb66655a7c7e92559104006d93a91f39cfb6c5c3a
Instruction Fuzzy Hash: D85105B190072DDFDB60DF99C884BDDBBB5BF48314F14809AE809A7210DB759A98CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02F3BC70 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02F3BCFF

Memory Dump Source

Source File: 00000005.00000002.510628436.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f30000_vOqVEnqC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a88ea01cbda7b8b3de4016bd8115754baaef506df253b6b34675863a270438c6
Instruction ID: c1ee0663399b4fa9b2a90912971982df20b121dbb49c399ac4db270b59166c31
Opcode Fuzzy Hash: a88ea01cbda7b8b3de4016bd8115754baaef506df253b6b34675863a270438c6
Instruction Fuzzy Hash: 7A2125B19002499FDB10CFAAD884ADEBFF4FB48314F14846AE855A3310C374A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0791DBD0 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 0791DC5D

Memory Dump Source

Source File: 00000005.00000002.578954850.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7910000_vOqVEnqC.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 351fd5638aab55c7fa1387bd70f7bcd8e84a3f3bddd5b46c6cadfd1b493ffa5f
Instruction ID: 7d4cfd786c3af8b2271f264623aa7b8bf31c4e3b0a02bc1ce806a91f0c8b87df
Opcode Fuzzy Hash: 351fd5638aab55c7fa1387bd70f7bcd8e84a3f3bddd5b46c6cadfd1b493ffa5f
Instruction Fuzzy Hash: B02125B1A003599FCB10CF9AC885BDEBBF4FF48310F10842AE819A7240D374A954CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 02F3BC78 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02F3BCFF

Memory Dump Source

Source File: 00000005.00000002.510628436.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f30000_vOqVEnqC.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3b4da1c5836b1b8b6ece5e441f764b4a7e978354e43506b16b1f58035e78f461
Instruction ID: 35504ee7751ebc20413f23139563609a459b31f51875af132c94ae3de23b2a73
Opcode Fuzzy Hash: 3b4da1c5836b1b8b6ece5e441f764b4a7e978354e43506b16b1f58035e78f461
Instruction Fuzzy Hash: 9A21E2B5D002099FDB10CFAAD984ADEBBF8FB48324F14841AE915A7310D378A944DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0791DA58 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0791DAD7

Memory Dump Source

Source File: 00000005.00000002.578954850.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7910000_vOqVEnqC.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 20e3b61437f623c700a4f64b69b2e26fbfc5c48adc0b4fb1bb25f973ba91fd12
Instruction ID: 735990dc5ce702a919a294959af33a2ef4fa6d40a3a0a9085d1921e5dad8a3e1
Opcode Fuzzy Hash: 20e3b61437f623c700a4f64b69b2e26fbfc5c48adc0b4fb1bb25f973ba91fd12
Instruction Fuzzy Hash: 2E21EFB19002599FCB10CF9AD984BDEBBF4FB48320F10842AE919A7250D378A954DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0791D998 Relevance: 1.6, APIs: 1, Instructions: 58
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 0791DA0F

Memory Dump Source

Source File: 00000005.00000002.578954850.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7910000_vOqVEnqC.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 879878568d4521045b40509ca179e6b17826d586001b03743f9f2eb09eee9f19
Instruction ID: 0d925e8c990a80bdb850c0243e8bbe94287673633f8df8d8d85df2bfa3d6e1b9
Opcode Fuzzy Hash: 879878568d4521045b40509ca179e6b17826d586001b03743f9f2eb09eee9f19
Instruction Fuzzy Hash: 8A21F7B1D0061A9FCB10CF9AC9857DEFBF8BB48714F148129D419B7640D774A9548FA1

Uniqueness

Uniqueness Score: -1.00%

Function 07916918 Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07916993

Memory Dump Source

Source File: 00000005.00000002.578954850.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7910000_vOqVEnqC.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 27c30af690ee6f0898a26739b13ce2f2b81b439d6e1ab1afc9178c337418b9b5
Instruction ID: 21787ece6a2c28b4b3c438d66afaf58e7a7b806990a638f89071358f369ea94c
Opcode Fuzzy Hash: 27c30af690ee6f0898a26739b13ce2f2b81b439d6e1ab1afc9178c337418b9b5
Instruction Fuzzy Hash: 602117B5D002099FCB10CF9AC884BDEFBF4FB48320F148429E859A7240D778A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F39BB0 Relevance: 1.6, APIs: 1, Instructions: 56
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02F39A11,00000800,00000000,00000000), ref: 02F39C22

Memory Dump Source

Source File: 00000005.00000002.510628436.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f30000_vOqVEnqC.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d764c5e5ac734e0be6cc8d676899c26809ae127e40c689028e4de8a4c6c66944
Instruction ID: 31fca3ae0010d34b20773dbbfb8a157837a712accb7cefe51ed53ce00d3cd228
Opcode Fuzzy Hash: d764c5e5ac734e0be6cc8d676899c26809ae127e40c689028e4de8a4c6c66944
Instruction Fuzzy Hash: 802103B2D002499FDB10CF9AC884ADEBBF4EB49750F14846AD855AB600C3B8A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F38CF8 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02F39A11,00000800,00000000,00000000), ref: 02F39C22

Memory Dump Source

Source File: 00000005.00000002.510628436.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f30000_vOqVEnqC.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: aa84a8e5b1769e55a4e3f749ff41f7bcdc7d8d6d4f64ce50ee3468b6487429e8
Instruction ID: 3a3119e34c38b6f59b9ce65c9a4683d6e33fe761aecd0eedd68a1a5655b35be2
Opcode Fuzzy Hash: aa84a8e5b1769e55a4e3f749ff41f7bcdc7d8d6d4f64ce50ee3468b6487429e8
Instruction Fuzzy Hash: 781103B2D002098FCB10CF9AC884ADEBBF4AB48760F10846AD915A7200C3B4A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07916920 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 07916993

Memory Dump Source

Source File: 00000005.00000002.578954850.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7910000_vOqVEnqC.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 863f6b8fb3cb6346650f78d56ed17bb6fbaf5ca8dfc80acd62f83513f619d8f4
Instruction ID: 7c1f6f65afb30b87a4ad3783d8e781a940fc2bb7f8754cc6190b401cc2a97f33
Opcode Fuzzy Hash: 863f6b8fb3cb6346650f78d56ed17bb6fbaf5ca8dfc80acd62f83513f619d8f4
Instruction Fuzzy Hash: 4021E4B5D002499FCB10CF9AC984BDEFBF4FB48320F108469E859A7250D778A684DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0791DB28 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0791DB93

Memory Dump Source

Source File: 00000005.00000002.578954850.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7910000_vOqVEnqC.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 821ef79547d0694c3f39252d6b7959467e8be0f621bca429a78a4899144fa67f
Instruction ID: f6c3ebdb99d7c820bb4a36b2272cf5f8548883d4c8713426caadbd234a132718
Opcode Fuzzy Hash: 821ef79547d0694c3f39252d6b7959467e8be0f621bca429a78a4899144fa67f
Instruction Fuzzy Hash: 0211F2B59002499FCB10CF9AC888BDEBFF8FB48324F108419E529A7210C375A994CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02F39930 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02F39996

Memory Dump Source

Source File: 00000005.00000002.510628436.0000000002F30000.00000040.00000800.00020000.00000000.sdmp, Offset: 02F30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2f30000_vOqVEnqC.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3e6b5d226011f6765f5813da0064c80eed0bff3f65878dac96356cc362e77482
Instruction ID: 2f8e9064128a75bd863d9a031561e803cf81cb900224ab0530a558bbdd712925
Opcode Fuzzy Hash: 3e6b5d226011f6765f5813da0064c80eed0bff3f65878dac96356cc362e77482
Instruction Fuzzy Hash: 0D110FB2C002498FCB10CF9AC484BDEFBF4AB88364F10846AD869B7600C3B4A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0791A7B8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0791E715

Memory Dump Source

Source File: 00000005.00000002.578954850.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7910000_vOqVEnqC.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 661cfe81449bc0f86f6978b418b5dfb9ad280ba44313f94053e7d98a6638b5b9
Instruction ID: 11f65b8f8321d75ae0923f0b7edac33bb55865884d4c4f4fc62852258d5d790e
Opcode Fuzzy Hash: 661cfe81449bc0f86f6978b418b5dfb9ad280ba44313f94053e7d98a6638b5b9
Instruction Fuzzy Hash: 5111F5B58003499FDB10DF9AC888BDEBBF8EB49324F108859E855A7700C374A994CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0791DD88 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0791DDE7

Memory Dump Source

Source File: 00000005.00000002.578954850.0000000007910000.00000040.00000800.00020000.00000000.sdmp, Offset: 07910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7910000_vOqVEnqC.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a1e885b14b0ede68f3fa410bab949c12a051f23570cd70c05e5fe9193f4a2c77
Instruction ID: abc6e280c0408c447f7f3bcbf030c809d523839f4107408ee42dc49c25f0a4b1
Opcode Fuzzy Hash: a1e885b14b0ede68f3fa410bab949c12a051f23570cd70c05e5fe9193f4a2c77
Instruction Fuzzy Hash: 3211E5B59002598FCB10CF9AD984BDEBBF4EB48724F10845AD419B7640C775A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 012BD4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.507093841.00000000012BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12bd000_vOqVEnqC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6761631aeb8eb6574ca899b93e035f4f1723e825ab7482ce0d27c22d32a1a986
Instruction ID: 552f2d9311a88e65589d24d5a9e8af2ee14a63eb5381c33d89ce0da0771899dd
Opcode Fuzzy Hash: 6761631aeb8eb6574ca899b93e035f4f1723e825ab7482ce0d27c22d32a1a986
Instruction Fuzzy Hash: E0213671514249DFDB16CF48E8C0BD6BF61FB8436CF248569D9060B206C336E846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012BD3B4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.507093841.00000000012BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12bd000_vOqVEnqC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58fb1d082e4ec41d3575c6b6cb595164c7100e4f33348a5b2b293723d81ba1cf
Instruction ID: 798fac10ac51226601e3e97aaffa9d8d549dc691bbdb001ec3c8c1da1422b7be
Opcode Fuzzy Hash: 58fb1d082e4ec41d3575c6b6cb595164c7100e4f33348a5b2b293723d81ba1cf
Instruction Fuzzy Hash: 4221F1B1514249DFDB05DF58D8C0BD6BF75FB84368F24C569E9050B207C33AE856CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 012CD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.507411134.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12cd000_vOqVEnqC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0b6d32da173a8b6a2a7bc79382ba809de24d99c47f554c7256d221fe80f5d4
Instruction ID: 1f4e4bd8f2eeb7ca770fd1d448d1d6aaed03dbfd785e361cf4238b99cc55566b
Opcode Fuzzy Hash: 1c0b6d32da173a8b6a2a7bc79382ba809de24d99c47f554c7256d221fe80f5d4
Instruction Fuzzy Hash: C8212575514248DFDB15CF5CD4C0B16BBA1FB84B64F20CA7DDA4A0B246C376D847CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 012CD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.507411134.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12cd000_vOqVEnqC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b1d98fa5f91a0a6476a79820e9c068a95affe0761bd37b5e04f88dfdf351d2f
Instruction ID: 15aa77f14372282b3449be0d3191e15d9fd9f6cc0ee974d5eccc53a2435ba6af
Opcode Fuzzy Hash: 5b1d98fa5f91a0a6476a79820e9c068a95affe0761bd37b5e04f88dfdf351d2f
Instruction Fuzzy Hash: 46212871554244DFDB01DF54D9C0B16BB62FB84B24F20C77DDA494B247C376D846CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 012CD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.507411134.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12cd000_vOqVEnqC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9f4250f4cbb1aebae603e057f422445bbc43caec938f6f5ddb9e84c6bac239
Instruction ID: c4558a2302e7fc5ffb39ab3a0e3b02acf77caef8732b11d3408407f8e07c90ec
Opcode Fuzzy Hash: cc9f4250f4cbb1aebae603e057f422445bbc43caec938f6f5ddb9e84c6bac239
Instruction Fuzzy Hash: FD2180755083849FCB03CF28D994B11BF71EB46314F28C6EAD9458F657C33A984ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 012BD3AF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.507093841.00000000012BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12bd000_vOqVEnqC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction ID: d516cad3355633ac091c187c6de4a1739c25a782ab053f286ac113cc94a24f0b
Opcode Fuzzy Hash: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction Fuzzy Hash: 83112676404284CFCB02CF54D5C0B96BF71FB84328F24C6A9D9440B617C33AE45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012BD49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.507093841.00000000012BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12bd000_vOqVEnqC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction ID: e34c88c93dedfba59d7941d9b45000ea98fead741278f25a97310d2e2a275129
Opcode Fuzzy Hash: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction Fuzzy Hash: 8E110376904285CFDB12CF48D5C0B96BF71FB84328F28C6A9D9050B617C336D456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 012CD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.507411134.00000000012CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 012CD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_12cd000_vOqVEnqC.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f825cc49a36603e58b05d30dbcded4ff69a659c0c942629433790640a090c2f4
Instruction ID: c5f9feb3e8d1c6e242d0198f584b2bc77612c1432b60ca3b31119d9461e747f8
Opcode Fuzzy Hash: f825cc49a36603e58b05d30dbcded4ff69a659c0c942629433790640a090c2f4
Instruction Fuzzy Hash: D111BE76544284DFDB02CF54C5C0B15BBA2FB84724F24C6ADDA494B657C33AD44ACBA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: shipping_documents.exePID: 1544, Parent PID: 64COMMON

Execution Graph

Execution Coverage:	15.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	232
Total number of Limit Nodes:	16

Executed Functions

Function 062A2508 Relevance: 1.8, APIs: 1, Instructions: 304
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 062A275F

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 01fac1a660198b15a0131558e5c62c06cdda668708e71cef71064d50fa238fa8
Instruction ID: 497a817cb559b5e0d78ee74b8eb35e0b5e093bfe28ecf7e1c3b1aaab68d3774f
Opcode Fuzzy Hash: 01fac1a660198b15a0131558e5c62c06cdda668708e71cef71064d50fa238fa8
Instruction Fuzzy Hash: 88B1A130A11306DFCB44EBB4D845AAEBBF2BF84300B148569E446DB355DF78E906CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 062A5048 Relevance: 1.7, APIs: 1, Instructions: 180
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 062A5089

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 129608384bf4bcdf4165af48348285e1171e805609c45854a1514e991a4e8889
Instruction ID: 556f71fe2167a94ac2e6447c8ebba8bf360103106174a69253e172530c82aea3
Opcode Fuzzy Hash: 129608384bf4bcdf4165af48348285e1171e805609c45854a1514e991a4e8889
Instruction Fuzzy Hash: 07614D30E20306DFDB54EFB4D4557AEBBB1BF84305F108429E802A7254DFB89846CB94

Uniqueness

Uniqueness Score: -1.00%

Function 062AADDD Relevance: 1.7, APIs: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 062AAF62

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: db502a0715223eda2428213a351b0988aa4557f08a183a68973f979a912b5137
Instruction ID: 5aa450862426be2d8fe93e88e11b9bcd16c858d3dc1e7cd76d01d41231155ae3
Opcode Fuzzy Hash: db502a0715223eda2428213a351b0988aa4557f08a183a68973f979a912b5137
Instruction Fuzzy Hash: FC510EB1C11349AFCF06CFA9C980ADEBFB2BF48310F15816AE818AB221D7759945DF50

Uniqueness

Uniqueness Score: -1.00%

Function 062A2700 Relevance: 1.6, APIs: 1, Instructions: 138
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 062A275F

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e583fb6023437f9a8c3fafdaa4a9388b3f6583301cd92978e9f4b38c10f5a451
Instruction ID: 4068ace915f3def9ddfcab38947fcda40a66bc383c2a5b175f19e00dc605090d
Opcode Fuzzy Hash: e583fb6023437f9a8c3fafdaa4a9388b3f6583301cd92978e9f4b38c10f5a451
Instruction Fuzzy Hash: 5E41D170A20306DFCB04EFB4C844AAEBBB5FF84300F148529E542DB285DF78A9058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 062A8A34 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 062AAF62

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ac69225059a1f22257921181cbdfc66901aef72b5faa30ab7b0abec2469d5a75
Instruction ID: 3e5aa7ce635b90df5ccf30c8dd2f03f20542c6306a94d9f945e537e7af102168
Opcode Fuzzy Hash: ac69225059a1f22257921181cbdfc66901aef72b5faa30ab7b0abec2469d5a75
Instruction Fuzzy Hash: 7051C1B1D10309DFDB14CF9AC984ADEBBB5BF48710F64852AE819AB210D7B5A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 062ACAFC Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 062AE879

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: ffdf532706df4a8bdab6fcdfc27f485525b3bf2a0654bc46a96c470504933b1f
Instruction ID: 12eb50c736a82a1d1d0a2e69ea98f4a21d140cad6d51fe250b41c001f77f8cb4
Opcode Fuzzy Hash: ffdf532706df4a8bdab6fcdfc27f485525b3bf2a0654bc46a96c470504933b1f
Instruction Fuzzy Hash: 2B415AB4D10305CFDB50CF99C488AAABFF5FF88314F258459D959AB321C7B4A841DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 062ADDB0 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,062ADC52), ref: 062ADE47

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 386c5b3dc8f2d9949758960218c4622920e0934669aba7eb808edb5f5595bcbd
Instruction ID: 4b6974c483488211d72ea4a4de3fa71e25f0a966a06f6036ce337fd97cd4836c
Opcode Fuzzy Hash: 386c5b3dc8f2d9949758960218c4622920e0934669aba7eb808edb5f5595bcbd
Instruction Fuzzy Hash: B121BDB1C047999FCB00CFAAC844BDEBFB4AF0A350F0985AAC454A7682D3785945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0118B3E8 Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 0118D01A

Memory Dump Source

Source File: 00000006.00000002.589285476.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1180000_shipping_documents.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e0cc20321ad8e152d175223cc5a446805090156bd9f0bc4e436e85ba63b51c44
Instruction ID: 1b934ec6edfef8bbe9aafa5e9c25c192693e3c5156e4e5369da4771f60a2c9cf
Opcode Fuzzy Hash: e0cc20321ad8e152d175223cc5a446805090156bd9f0bc4e436e85ba63b51c44
Instruction Fuzzy Hash: C03147B0D00359CFDB18DFA9D4847DEBBF1AF08310F148129E815AB280D7789442CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0118CF45 Relevance: 1.6, APIs: 1, Instructions: 88
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 0118D01A

Memory Dump Source

Source File: 00000006.00000002.589285476.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1180000_shipping_documents.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 805ef5291dc0771e6a7a60995cff48695a76b54ca3cdadc5e5d77d2bb5ca7aac
Instruction ID: 27cceecfd8d5d72fbd17ec471368b71a752a79402e8f09fb49f4086015b6fb0a
Opcode Fuzzy Hash: 805ef5291dc0771e6a7a60995cff48695a76b54ca3cdadc5e5d77d2bb5ca7aac
Instruction Fuzzy Hash: 4E3142B0D00359CFDB18DFA9D4847DEBBB1AB08310F14812AE815EB290D7789482CF96

Uniqueness

Uniqueness Score: -1.00%

Function 06566158 Relevance: 1.6, APIs: 1, Instructions: 85
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,00000000,?), ref: 06566211

Memory Dump Source

Source File: 00000006.00000002.636621442.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6560000_shipping_documents.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4195d2667e9a778ecbb454881938c38a5d3d65a933a73469fdbfe19cffcd4211
Instruction ID: e9aaaaeeed0b4287ab04b031249b141f5665eefbbb554b6eeded6970cd50c04c
Opcode Fuzzy Hash: 4195d2667e9a778ecbb454881938c38a5d3d65a933a73469fdbfe19cffcd4211
Instruction Fuzzy Hash: E131DCB1D00258DFCB20CF9AC884ACEBBF5BF48710F54812AE819AB214D774A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06565EA0 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,00000000,?,00000001,?), ref: 06565F54

Memory Dump Source

Source File: 00000006.00000002.636621442.0000000006560000.00000040.00000800.00020000.00000000.sdmp, Offset: 06560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6560000_shipping_documents.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f8d4f1b17b00a65c8ed19d49393fbf5be05145793fade6aee16eac16c90707e5
Instruction ID: 1ef2f08a013a001c5ef0c2169fcb91868e0d3b15928aba5a425313d87950a7a6
Opcode Fuzzy Hash: f8d4f1b17b00a65c8ed19d49393fbf5be05145793fade6aee16eac16c90707e5
Instruction Fuzzy Hash: 8C31FFB1D002498FDB10CF9AC584A8EFFF5BF48304F28816AE409AB341D7759984CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 062AC70C Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,00000023,?,?,?,?), ref: 062ACFDF

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f37684a2c7d4d2a2acd2e010704d2988b03ff85e63f735b85dab6dafd74e26f0
Instruction ID: dfc1e933e3f490ab18dccc9a5220cbd2e2c6563dbd2d632ef235c3f4fd4537f6
Opcode Fuzzy Hash: f37684a2c7d4d2a2acd2e010704d2988b03ff85e63f735b85dab6dafd74e26f0
Instruction Fuzzy Hash: BA21E5B59103099FDB10CF9AD984ADEBFF4EB48320F14841AE915B7310D378A944DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 062ACF57 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,00000023,?,?,?,?), ref: 062ACFDF

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 09ab83f4603400337a9f688e0eaa5d934dab9fe11d2b33ea9a4f48ebd20ce080
Instruction ID: 80630ca67d8671013c80d7d998c0511298a60e107d81bc04671f75ca6bfaf2a9
Opcode Fuzzy Hash: 09ab83f4603400337a9f688e0eaa5d934dab9fe11d2b33ea9a4f48ebd20ce080
Instruction Fuzzy Hash: 9C21E2B5D002099FDB00CFAAD984AEEBBF4EB48320F14841AE914B7310D378A944DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01185048 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 011850D2

Memory Dump Source

Source File: 00000006.00000002.589285476.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1180000_shipping_documents.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 7a817119dec5c1b4d3c0d21884aa02fbc20c3b3b7081c7278336ddf6b6676655
Instruction ID: fda090519bba5a5942969a3bf62d948901695593d8b29cba72c03b781acd289b
Opcode Fuzzy Hash: 7a817119dec5c1b4d3c0d21884aa02fbc20c3b3b7081c7278336ddf6b6676655
Instruction Fuzzy Hash: F2218CB19013098FDB50EFA9C9497EEBFF8FB45310F14816AE505A3600CB396544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 062ACA98 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,062ADC52), ref: 062ADE47

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 23a240f8ce55ec66c020bded13a379ec2f56084473e8868b0cc0f3abe08424ae
Instruction ID: af6d7eec050195357334df116fd72463de37f5c91ff97b75d31c5427c935b42b
Opcode Fuzzy Hash: 23a240f8ce55ec66c020bded13a379ec2f56084473e8868b0cc0f3abe08424ae
Instruction Fuzzy Hash: B111F2B1C1061A9BCB10CF9AC9447EEFBB4AF48720F14856AD814B7640D7B8A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01185058 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 011850D2

Memory Dump Source

Source File: 00000006.00000002.589285476.0000000001180000.00000040.00000800.00020000.00000000.sdmp, Offset: 01180000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1180000_shipping_documents.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 37cece3d022ccadc1432dd6d468033aefde41833ac618747e7360df198f0cfd1
Instruction ID: e192d7ce25ab72f4d56d187b6c725ff9fbba88a116793f469376536bd8940372
Opcode Fuzzy Hash: 37cece3d022ccadc1432dd6d468033aefde41833ac618747e7360df198f0cfd1
Instruction Fuzzy Hash: 501179B09013098FDB50EFA9C6487AEBFF9FB44314F24C46AD505A7600CB79A544CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 062AE226 Relevance: 1.6, APIs: 1, Instructions: 51comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 062AFB45

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 1ae7e8c995c72f516e223cbca06022be549c16b150c255e1a5dbfd2a60224687
Instruction ID: 6e6d4b73c780a8cea5f15c9cf03ce821794c676506684791b0f21d75f779f6ab
Opcode Fuzzy Hash: 1ae7e8c995c72f516e223cbca06022be549c16b150c255e1a5dbfd2a60224687
Instruction Fuzzy Hash: 531158B1904348CFCB10CF9AC588BDEBFF4EB48320F24845AD859A7611C7B8A944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 062A5045 Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 062A5089

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 41d67c595280befedb3b3f5c7c6822d4170d7a90b2acd59e5d27eee305007913
Instruction ID: 09057e95b2f55149651357bbc6cfda2b54725f1aacfcfd84b4ed6a362df3e6ec
Opcode Fuzzy Hash: 41d67c595280befedb3b3f5c7c6822d4170d7a90b2acd59e5d27eee305007913
Instruction Fuzzy Hash: 83116070D21309DFCB04DFA4D484A9EBBB1FF48315F208428E401BB254CBB5A885CF54

Uniqueness

Uniqueness Score: -1.00%

Function 062A13B4 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 062A954E

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 6dddad563fe6f5aedaded4dd63f675d69e341d54831e3c58414dbbccf8876c84
Instruction ID: e72527783f0834eceb1f1de827b486c481cce50ecd31066b5ba9a33e1bea0b6b
Opcode Fuzzy Hash: 6dddad563fe6f5aedaded4dd63f675d69e341d54831e3c58414dbbccf8876c84
Instruction Fuzzy Hash: 2E1104B5C103498FDB10CF9AC444ADEFBF4EF88324F14846AD829A7610D3B4A585CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 062AF0F2 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,?,?,062AF117), ref: 062AF1A7

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8e14da6af88746ec54cd1d36c1ce1275dfa46b905f7035cafdca17dc1d19cb19
Instruction ID: 31800072cb077b499ade6d21f6add0b8f056437a304d8714ff64ecaabd6a5343
Opcode Fuzzy Hash: 8e14da6af88746ec54cd1d36c1ce1275dfa46b905f7035cafdca17dc1d19cb19
Instruction Fuzzy Hash: 28117CB6A043448FCB10DFE9D89479EBFF0EF85310F15489AD559EB261C778A844CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 062AFAE8 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 062AFB45

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: b773851b5d67c0e154eefc5706654fea09d751d4289396b6fefbe2d69ca16aa8
Instruction ID: ce20e8adfef63b03da8566b329041e24cf6f0cf04f2f104a82ba724e1c1a95df
Opcode Fuzzy Hash: b773851b5d67c0e154eefc5706654fea09d751d4289396b6fefbe2d69ca16aa8
Instruction Fuzzy Hash: 471136B58003488FCB20CF9AD584BDEBFF8AB48720F14845AD855A7600C378A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 062A94E5 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 062A954E

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: abc2d00b4923d563635436b4015fb64ef2ea41b088f101240084848937b74058
Instruction ID: 078827bfd1ee5e79695d75402d614632701169b9a4bf67076b9142f1ad6592c4
Opcode Fuzzy Hash: abc2d00b4923d563635436b4015fb64ef2ea41b088f101240084848937b74058
Instruction Fuzzy Hash: 331113B6D103098FCB10CF9AD444ADEFBF5AF88324F14846AD829A7610D378A585CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 062AE234 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 062AFB45

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: e87057a8c95588e8de6008089989b7d72b19e9ef7802e5b92c36dffea10c2271
Instruction ID: 430099839c0a08bded1398ff246e8d8edaadc8cadd0369d0bf86e537f7fc3468
Opcode Fuzzy Hash: e87057a8c95588e8de6008089989b7d72b19e9ef7802e5b92c36dffea10c2271
Instruction Fuzzy Hash: E41145B1910349CFCB10CF9AC584BDEBBF4EB48320F24841AD919A7600C3B8A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 062AFB7C Relevance: 1.5, APIs: 1, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 062AFB45

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: bae155cc9c4a9fa4e5619a5f57231e6efdf9f2abd49622598253812acd0f204b
Instruction ID: bddb8a5cfc3a039d9a1b28ecb5b7750879d5c8ebe4fe38b48011eb6cfaed6e15
Opcode Fuzzy Hash: bae155cc9c4a9fa4e5619a5f57231e6efdf9f2abd49622598253812acd0f204b
Instruction Fuzzy Hash: B6F059729083808FC75087AD88643D9FFF0DF54308F24899EC446D7561C3BC9185D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 062AF179 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?,?,?,?,?,?,?,?,062AF117), ref: 062AF1A7

Memory Dump Source

Source File: 00000006.00000002.635540830.00000000062A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 062A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_62a0000_shipping_documents.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: dc1b345e91f90f7ce8afa8bc0cf53631f8e1c675914fa6b7e7d61e702c74d111
Instruction ID: bd6bd8c36518a39f9d3494fc47cae8b554508eb6df90c3aae3e7884b127b7c2f
Opcode Fuzzy Hash: dc1b345e91f90f7ce8afa8bc0cf53631f8e1c675914fa6b7e7d61e702c74d111
Instruction Fuzzy Hash: B3F0C4B5900209CFDB10DB99D8847DEBBF4AF88324F24846AD519A7650C779A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0112DA01 Relevance: 1.2, Instructions: 1248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.588761344.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_112d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788027bc89231bd2b384e78422a3626c241a2d71f2ffa0887d9664de0b027d81
Instruction ID: f662d66e2b974452d3678498bf41fb912f024ebfd0f8ebb9b1e34104347fc0bf
Opcode Fuzzy Hash: 788027bc89231bd2b384e78422a3626c241a2d71f2ffa0887d9664de0b027d81
Instruction Fuzzy Hash: 3542D67649E3D19FD3478BB0E8666853FB09F13230B4E41DBD880CA1A3E25D595ACB36

Uniqueness

Uniqueness Score: -1.00%

Function 0112E16B Relevance: .3, Instructions: 319COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.588761344.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_112d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0c079f5f95b2526da19331c61a9188af944944c5a3c44d6317f11c47450a8b
Instruction ID: 09613654c4b43f2c52600b9a6fc7371c28a89344f5f0a531a1671cbbadad5344
Opcode Fuzzy Hash: 8c0c079f5f95b2526da19331c61a9188af944944c5a3c44d6317f11c47450a8b
Instruction Fuzzy Hash: F281307645D3819FD3478BA0D8567813FB1EB13231F1A41DAD884CB1A3D26D985ACB72

Uniqueness

Uniqueness Score: -1.00%

Function 0111D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.588579094.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_111d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ee44042d9a7167049db6115651ce9c22cef0dd5d8bfa86d23deef17be450c04
Instruction ID: 7fea810f2df4a5527da1f9402e213aacae3489ff644039258d5d3f4ffea056dd
Opcode Fuzzy Hash: 4ee44042d9a7167049db6115651ce9c22cef0dd5d8bfa86d23deef17be450c04
Instruction Fuzzy Hash: 2D21B271504240DFDF49DF58E9C8B16BF75FB88328F248579E9050B21AC336D856DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0112E3DC Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.588761344.000000000112D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0112D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_112d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8af854d0b3572d0de2df5a5df5390d1b1484b50fe492466e2fe2e1ce790c303
Instruction ID: 5f17308c8ec3c5bf2408dc91cfec6e0e1f66dca6a8a04a85bf52c1038f0e4b3c
Opcode Fuzzy Hash: e8af854d0b3572d0de2df5a5df5390d1b1484b50fe492466e2fe2e1ce790c303
Instruction Fuzzy Hash: 17210775504280DFDB09DF18D9C4B16BF65FB84324F24C66DD9498B346C336D856CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0111D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.588579094.000000000111D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0111D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_111d000_shipping_documents.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction ID: 93fbc1d2819fca668feefe603ad6b881bdb18c3bf8e789d974533a0acee8f411
Opcode Fuzzy Hash: b3d282c62180620417641dd9b9a0e49e7b7255b4f86f8dc055538552fd58bc37
Instruction Fuzzy Hash: 9B11D376504280CFDF16CF54D5C4B16FF71FB84324F2486A9D8050B61AC33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report shipping_documents.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LIhMQ.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\shipping_documents.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vOqVEnqC.exe.log

C:\Users\user\AppData\Local\Temp\tmp243C.tmp

C:\Users\user\AppData\Local\Temp\tmp3F0C.tmp

C:\Users\user\AppData\Local\Temp\tmpE4E1.tmp

C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe

C:\Users\user\AppData\Roaming\LIhMQ\LIhMQ.exe:Zone.Identifier

C:\Users\user\AppData\Roaming\vOqVEnqC.exe

C:\Windows\System32\drivers\etc\hosts

Static File Info

General

Windows Analysis Report
shipping_documents.exe

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre