Edit tour

Windows Analysis Report
HAhJORNtiOFCEGH.exe

Overview

General Information

Sample name:	HAhJORNtiOFCEGH.exe
Analysis ID:	1436312
MD5:	71188fae17ca6e068158080cd9be278a
SHA1:	1d2aaa378a8543283ab0af492da4351557948eab
SHA256:	1a220cf90de5204b1f33c388537f695421fc1388dd2ed8315efa211d0113ea6e
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

HAhJORNtiOFCEGH.exe (PID: 1220 cmdline: "C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe" MD5: 71188FAE17CA6E068158080CD9BE278A)

MSBuild.exe (PID: 1732 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.pu.edu.af", "Username": "saif.rohi@pu.edu.af", "Password": "Ro#@.com55"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3213980028.00000000026F9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2008352418.0000000005990000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2000500638.0000000004B12000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2000500638.0000000004B12000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.3212849902.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3212849902.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1997458410.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000002.3213980028.0000000002681000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3213980028.0000000002681000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1997458410.000000000311E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Process Memory Space: HAhJORNtiOFCEGH.exe PID: 1220	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: HAhJORNtiOFCEGH.exe PID: 1220	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: HAhJORNtiOFCEGH.exe PID: 1220	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 1732	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 1732	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.HAhJORNtiOFCEGH.exe.5990000.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.2f17450.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33525:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33641:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3371d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33843:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.HAhJORNtiOFCEGH.exe.5990000.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.2f17450.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.41ee278.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.41ee278.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.HAhJORNtiOFCEGH.exe.41ee278.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31725:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31841:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3191d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a43:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.HAhJORNtiOFCEGH.exe.2ed35b4.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.4228c98.7.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.4228c98.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.HAhJORNtiOFCEGH.exe.4228c98.7.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31725:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31841:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3191d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a43:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ded3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33525:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df45:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfcf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33641:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e061:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3371d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e13d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33843:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e263:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.HAhJORNtiOFCEGH.exe.315b5ac.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33525:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33641:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3371d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33843:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.HAhJORNtiOFCEGH.exe.315857c.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.HAhJORNtiOFCEGH.exe.3159594.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 22 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 103.132.98.224, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 1732, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49704

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: HAhJORNtiOFCEGH.exe

Avira: detected

Found malware configuration

Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.pu.edu.af", "Username": "saif.rohi@pu.edu.af", "Password": "Ro#@.com55"}

Multi AV Scanner detection for submitted file

Source: HAhJORNtiOFCEGH.exe	ReversingLabs: Detection: 60%
Source: HAhJORNtiOFCEGH.exe	Virustotal: Detection: 61%			Perma Link

Machine Learning detection for sample

Source: HAhJORNtiOFCEGH.exe

Joe Sandbox ML: detected

Source: HAhJORNtiOFCEGH.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49709 version: TLS 1.0

Source: HAhJORNtiOFCEGH.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 103.132.98.224:587

Source: Joe Sandbox View

JA3 fingerprint: 1138de370e523e824bbca92d049a3777

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 103.132.98.224:587

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49709 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.pu.edu.af

Source: MSBuild.exe, 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.pu.edu.af
Source: MSBuild.exe, 00000002.00000002.3217189090.0000000005A12000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3217189090.0000000005A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/03
Source: MSBuild.exe, 00000002.00000002.3217189090.0000000005A12000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3217189090.0000000005A3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: MSBuild.exe, 00000002.00000002.3217189090.0000000005A12000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: MSBuild.exe, 00000002.00000002.3217189090.0000000005A12000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: HAhJORNtiOFCEGH.exe, 00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp, HAhJORNtiOFCEGH.exe, 00000000.00000002.2000500638.0000000004B12000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3212849902.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, lBLTBzkV.cs	.Net Code: h9f
Source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack, lBLTBzkV.cs	.Net Code: h9f

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Code function: 0_2_0157EFC4	0_2_0157EFC4
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Code function: 0_2_054B0040	0_2_054B0040
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Code function: 0_2_054B0006	0_2_054B0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00A99370	2_2_00A99370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00A94A98	2_2_00A94A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00A99BE8	2_2_00A99BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00A93E80	2_2_00A93E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00A9CE70	2_2_00A9CE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00A941C8	2_2_00A941C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4DD00	2_2_05B4DD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4BCF0	2_2_05B4BCF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B43F48	2_2_05B43F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B456D8	2_2_05B456D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B40040	2_2_05B40040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B48B98	2_2_05B48B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B42AF0	2_2_05B42AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B44FF8	2_2_05B44FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B43248	2_2_05B43248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00A99BE0	2_2_00A99BE0

Source: HAhJORNtiOFCEGH.exe, 00000000.00000002.1997458410.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs HAhJORNtiOFCEGH.exe
Source: HAhJORNtiOFCEGH.exe, 00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0eb1f663-67ab-4af7-95d7-b04526baf746.exe4 vs HAhJORNtiOFCEGH.exe
Source: HAhJORNtiOFCEGH.exe, 00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs HAhJORNtiOFCEGH.exe
Source: HAhJORNtiOFCEGH.exe, 00000000.00000002.2008125884.0000000005850000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs HAhJORNtiOFCEGH.exe
Source: HAhJORNtiOFCEGH.exe, 00000000.00000002.1995982294.000000000104E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs HAhJORNtiOFCEGH.exe
Source: HAhJORNtiOFCEGH.exe, 00000000.00000002.2008617950.0000000006470000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs HAhJORNtiOFCEGH.exe
Source: HAhJORNtiOFCEGH.exe, 00000000.00000002.1997458410.0000000002F95000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0eb1f663-67ab-4af7-95d7-b04526baf746.exe4 vs HAhJORNtiOFCEGH.exe
Source: HAhJORNtiOFCEGH.exe	Binary or memory string: OriginalFilenameJgSD.exe8 vs HAhJORNtiOFCEGH.exe

Source: HAhJORNtiOFCEGH.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: HAhJORNtiOFCEGH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.HAhJORNtiOFCEGH.exe.2f17450.4.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.HAhJORNtiOFCEGH.exe.2f17450.4.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.raw.unpack, XG.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, kGWv.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, 84Zwl.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, Z80kh.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, R7VqEELv.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, iWM.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, tHB.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'

Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, Dc1iLNJ5UkRfSTkZN2.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, fHwdeZPJfBXj2YfMr4.cs	Security API names: _0020.SetAccessControl
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, fHwdeZPJfBXj2YfMr4.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, fHwdeZPJfBXj2YfMr4.cs	Security API names: _0020.AddAccessRule
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, Dc1iLNJ5UkRfSTkZN2.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, fHwdeZPJfBXj2YfMr4.cs	Security API names: _0020.SetAccessControl
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, fHwdeZPJfBXj2YfMr4.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, fHwdeZPJfBXj2YfMr4.cs	Security API names: _0020.AddAccessRule

Source: 0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.HAhJORNtiOFCEGH.exe.5990000.10.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.HAhJORNtiOFCEGH.exe.2f17450.4.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HAhJORNtiOFCEGH.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Mutant created: \Sessions\1\BaseNamedObjects\IWOrPDDBFuQR

Source: HAhJORNtiOFCEGH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: HAhJORNtiOFCEGH.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: HAhJORNtiOFCEGH.exe	ReversingLabs: Detection: 60%
Source: HAhJORNtiOFCEGH.exe	Virustotal: Detection: 61%

Source: unknown	Process created: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe "C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe"
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: HAhJORNtiOFCEGH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: HAhJORNtiOFCEGH.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.HAhJORNtiOFCEGH.exe.2f17450.4.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.HAhJORNtiOFCEGH.exe.5990000.10.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})

.NET source code contains potential unpacker

Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, fHwdeZPJfBXj2YfMr4.cs	.Net Code: pIsqOFBfgy System.Reflection.Assembly.Load(byte[])
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, fHwdeZPJfBXj2YfMr4.cs	.Net Code: pIsqOFBfgy System.Reflection.Assembly.Load(byte[])

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B4DC95 push eax; ret		2_2_05B4DCB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05B43AD3 push ebx; retf		2_2_05B43ADA

Source: HAhJORNtiOFCEGH.exe

Static PE information: section name: .text entropy: 7.977281565173417

Source: 0.2.HAhJORNtiOFCEGH.exe.2f17450.4.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, ruQ8tI6i2Em3fNYM2u.cs	High entropy of concatenated method names: 'cieAPGKLfO', 'GeTAcffNSM', 'ynqAqvNDCk', 'iOuAU2eG9n', 'pqaAXUKDZW', 'BHTAvowi6W', 'AGCAQ1laM6', 'rd4EBIsFfV', 'icqEiw7ZOc', 'TdPENydUwW'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, zVFp8RoNdyDYkSgkGw.cs	High entropy of concatenated method names: 'jKcO0CO9p', 'g5SrTykmM', 'tEloF0K9D', 'QbL1TLuSR', 'IwIgUFuwF', 'HfXMX53AP', 'tJG53gMC1ZF0hjI6vU', 'pK4qU0ieU2HJYNLwbH', 'yY9EUQa8R', 'J3DHcjCth'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, JJSuL8prqVlGxcasRx.cs	High entropy of concatenated method names: 'yJoeU0kFwj', 'r6BeLDLZ4W', 'BG3eQ9qsIi', 'AYOQCHUZiw', 'o5EQzOJ0Jw', 'AcYeWN4wKI', 'Q62ePOFnPm', 'u9HeDusW4b', 'FhTecHdVOC', 'qIoeqkn7NA'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, NLOTVdzMnNZQB8J18m.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ClaAslQHSV', 'ahtAnrRXej', 'EalAV8g9PJ', 'W26AdXPt9F', 'zdbAEusW9m', 'wpDAAPmpH2', 'iAbAH10BtS'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, sp9Hwt3dljIZtOueZJ.cs	High entropy of concatenated method names: 'OvGEppneaC', 'h7PEfdKAmE', 'IB0E8OgexM', 'X0hEJY8dTF', 'Fs6EY6nRRv', 'YHoE7ev38I', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, MDbDD9W5C0yYFqeWAL.cs	High entropy of concatenated method names: 'ToString', 'PM5V6lPmsD', 'zGpVfN5rl0', 'k8hV8hXygN', 'oTeVJyKHv6', 'ctCV70Xu0H', 'CnkV0pxOdp', 'Cc3Vl2UFtW', 'q74VkKIHc5', 'm4ZVRRefD6'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, UFNIfkOrSlIxN2DKIB.cs	High entropy of concatenated method names: 'w1bdbLb1aF', 'BEEdZjodtP', 'ToString', 'zPFdUWPwVp', 'b5NdX5RB4x', 'PdHdLm88Z4', 'jLDdvutAqy', 'zrGdQuqfAF', 'RG7de432bA', 'CKbd3Yf0tw'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, Dc1iLNJ5UkRfSTkZN2.cs	High entropy of concatenated method names: 'PF6XYIkEla', 'feWXj4TbZ3', 'w7xXSA6RE9', 'hwsX488gyC', 'h7mXFyt5ZO', 'E0wXyxIVYv', 'RkwXBjcn9t', 'II7XiTIhhT', 'nKIXNZbhK0', 'ftNXCFKd5F'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, RPFdcvtaBxxcVHrL0K.cs	High entropy of concatenated method names: 'JaSQxjSAEI', 'cmBQXJVQ7g', 'EtrQviB6N8', 'stqQexJVUZ', 'E56Q3MTOM0', 'e9JvF7FNDQ', 'xOLvyI9YXU', 'UuRvBqeUGp', 'E0WvimF2rw', 'YbuvNQx54q'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, YlojcY4b1rUNsD4COUy.cs	High entropy of concatenated method names: 'E78AuP1OM1', 'S3FAKSGbPc', 'oFvAOCBxX0', 'qIRArvanEV', 'UQnAhVybbt', 'hS2AoMilHZ', 'uf9A1qoRZ6', 'vLtAteZ38m', 'zXVAg283Vy', 'g2EAMjZIpf'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, R2d87GuSMyBCwj2CTo.cs	High entropy of concatenated method names: 'ITtLrQESdG', 'SSHLoRB1Bs', 'JDiLtXuLMw', 'mUBLgFTLvS', 'fe4LnoQfOR', 'v3ALVgx10H', 'COsLdCTkAb', 'gSqLEjwjCc', 'TEdLAMITfu', 'vlVLH0Bj5S'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, JyL7kuewXLW11uXMkt.cs	High entropy of concatenated method names: 'jO6euw8CHr', 'AYFeKyesfF', 'UYMeOjEqrR', 'PdQerGteHN', 'UNtehYxiti', 'hqjeoRibiN', 'ChPe16Y8XD', 'scMetMh190', 'pZFegww6eW', 'be6eMVqg8n'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, yHeMFIBT9KvmrXcaWR.cs	High entropy of concatenated method names: 'TrfdiDePrj', 'e4VdCHPM0F', 'LJMEWxLTUP', 'SJuEPOtEKT', 'eNld6PRk0I', 'RBcdwqh3i6', 'vHDd2o1ji3', 'zE2dYaV67l', 'odqdjyjwSV', 'ijcdS5sUPq'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, lWH37U4U7JCjq4wYTCA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oiHHYrbVhK', 'nUHHjluZgT', 'oFVHSo3OM8', 'BHRH4hixve', 'dYZHFRUl1I', 'lqmHyRbDLZ', 'B7OHBOA02E'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, aS4pFpaXJxb9RHadRc.cs	High entropy of concatenated method names: 'XTYEUCwyBJ', 'S30EXMZdaD', 'C0xELcXGZl', 'jBUEvPi8k6', 'g5JEQ8OJjY', 'w8BEeToxti', 'blFE3YjHvw', 'bk6EaR73M6', 'mGLEbWkbvx', 'kviEZ1t3M1'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, uiMtnU0RvnAe8rt9o0.cs	High entropy of concatenated method names: 'SkostZdh9p', 'kKQsgP3a3A', 'ct3spOytpW', 'XfVsfRPVme', 'pMdsJe4xjZ', 'IBus7anCC6', 'Weasl2ZAub', 'qobskUowJY', 'WqGsGmhW2a', 'NTqs6gd2eP'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, G3TejlwEAjCaHxvFL9.cs	High entropy of concatenated method names: 'UNw6Tc3QunRnXj1YGGO', 'pJk6sb3BsffCflGPh9R', 'V7EQEbEnKS', 'yNFQAbkZTJ', 'QisQHXeBvP', 'qvBa4K3ZGwP5DcmOxVs', 'JnYrkZ3abNrgVj2jMKj'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, fHwdeZPJfBXj2YfMr4.cs	High entropy of concatenated method names: 'zFjcxy8JJM', 'WdVcUWseZC', 'O5CcXm1wqq', 'lOecLA9og5', 'xfLcvDrmeo', 'Tm7cQbq4hL', 'DAyceRSnQS', 'FD9c3Z7qsC', 'uwxcaXFIpX', 'GbacbSDDv2'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, Iw57mIcu4Uipo3Drfu.cs	High entropy of concatenated method names: 'Dispose', 'kR1PNe6aRi', 'WZeDfj8Ehf', 'nViTT1klWO', 'siwPC0GS6G', 'I2xPz68Bet', 'ProcessDialogKey', 'JqbDW9Cs8M', 'HEXDP5YPAu', 'P6DDDlp8a3'
Source: 0.2.HAhJORNtiOFCEGH.exe.6470000.11.raw.unpack, JPjDV4GsB2OQCPkt36.cs	High entropy of concatenated method names: 'fMTPe3HgFH', 'eQMP3VG0NE', 'SfhPbsC3ke', 'DtJPZrqPHF', 'NeNPn0dTDu', 'msSPVPAhHA', 'IPCE1gjUsSA4n8swhL', 'DDgXoHdpr7dfRA7x7V', 'BAePPrCfbm', 'gG3PcpOF2r'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, ruQ8tI6i2Em3fNYM2u.cs	High entropy of concatenated method names: 'cieAPGKLfO', 'GeTAcffNSM', 'ynqAqvNDCk', 'iOuAU2eG9n', 'pqaAXUKDZW', 'BHTAvowi6W', 'AGCAQ1laM6', 'rd4EBIsFfV', 'icqEiw7ZOc', 'TdPENydUwW'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, zVFp8RoNdyDYkSgkGw.cs	High entropy of concatenated method names: 'jKcO0CO9p', 'g5SrTykmM', 'tEloF0K9D', 'QbL1TLuSR', 'IwIgUFuwF', 'HfXMX53AP', 'tJG53gMC1ZF0hjI6vU', 'pK4qU0ieU2HJYNLwbH', 'yY9EUQa8R', 'J3DHcjCth'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, JJSuL8prqVlGxcasRx.cs	High entropy of concatenated method names: 'yJoeU0kFwj', 'r6BeLDLZ4W', 'BG3eQ9qsIi', 'AYOQCHUZiw', 'o5EQzOJ0Jw', 'AcYeWN4wKI', 'Q62ePOFnPm', 'u9HeDusW4b', 'FhTecHdVOC', 'qIoeqkn7NA'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, NLOTVdzMnNZQB8J18m.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ClaAslQHSV', 'ahtAnrRXej', 'EalAV8g9PJ', 'W26AdXPt9F', 'zdbAEusW9m', 'wpDAAPmpH2', 'iAbAH10BtS'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, sp9Hwt3dljIZtOueZJ.cs	High entropy of concatenated method names: 'OvGEppneaC', 'h7PEfdKAmE', 'IB0E8OgexM', 'X0hEJY8dTF', 'Fs6EY6nRRv', 'YHoE7ev38I', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, MDbDD9W5C0yYFqeWAL.cs	High entropy of concatenated method names: 'ToString', 'PM5V6lPmsD', 'zGpVfN5rl0', 'k8hV8hXygN', 'oTeVJyKHv6', 'ctCV70Xu0H', 'CnkV0pxOdp', 'Cc3Vl2UFtW', 'q74VkKIHc5', 'm4ZVRRefD6'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, UFNIfkOrSlIxN2DKIB.cs	High entropy of concatenated method names: 'w1bdbLb1aF', 'BEEdZjodtP', 'ToString', 'zPFdUWPwVp', 'b5NdX5RB4x', 'PdHdLm88Z4', 'jLDdvutAqy', 'zrGdQuqfAF', 'RG7de432bA', 'CKbd3Yf0tw'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, Dc1iLNJ5UkRfSTkZN2.cs	High entropy of concatenated method names: 'PF6XYIkEla', 'feWXj4TbZ3', 'w7xXSA6RE9', 'hwsX488gyC', 'h7mXFyt5ZO', 'E0wXyxIVYv', 'RkwXBjcn9t', 'II7XiTIhhT', 'nKIXNZbhK0', 'ftNXCFKd5F'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, RPFdcvtaBxxcVHrL0K.cs	High entropy of concatenated method names: 'JaSQxjSAEI', 'cmBQXJVQ7g', 'EtrQviB6N8', 'stqQexJVUZ', 'E56Q3MTOM0', 'e9JvF7FNDQ', 'xOLvyI9YXU', 'UuRvBqeUGp', 'E0WvimF2rw', 'YbuvNQx54q'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, YlojcY4b1rUNsD4COUy.cs	High entropy of concatenated method names: 'E78AuP1OM1', 'S3FAKSGbPc', 'oFvAOCBxX0', 'qIRArvanEV', 'UQnAhVybbt', 'hS2AoMilHZ', 'uf9A1qoRZ6', 'vLtAteZ38m', 'zXVAg283Vy', 'g2EAMjZIpf'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, R2d87GuSMyBCwj2CTo.cs	High entropy of concatenated method names: 'ITtLrQESdG', 'SSHLoRB1Bs', 'JDiLtXuLMw', 'mUBLgFTLvS', 'fe4LnoQfOR', 'v3ALVgx10H', 'COsLdCTkAb', 'gSqLEjwjCc', 'TEdLAMITfu', 'vlVLH0Bj5S'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, JyL7kuewXLW11uXMkt.cs	High entropy of concatenated method names: 'jO6euw8CHr', 'AYFeKyesfF', 'UYMeOjEqrR', 'PdQerGteHN', 'UNtehYxiti', 'hqjeoRibiN', 'ChPe16Y8XD', 'scMetMh190', 'pZFegww6eW', 'be6eMVqg8n'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, yHeMFIBT9KvmrXcaWR.cs	High entropy of concatenated method names: 'TrfdiDePrj', 'e4VdCHPM0F', 'LJMEWxLTUP', 'SJuEPOtEKT', 'eNld6PRk0I', 'RBcdwqh3i6', 'vHDd2o1ji3', 'zE2dYaV67l', 'odqdjyjwSV', 'ijcdS5sUPq'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, lWH37U4U7JCjq4wYTCA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'oiHHYrbVhK', 'nUHHjluZgT', 'oFVHSo3OM8', 'BHRH4hixve', 'dYZHFRUl1I', 'lqmHyRbDLZ', 'B7OHBOA02E'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, aS4pFpaXJxb9RHadRc.cs	High entropy of concatenated method names: 'XTYEUCwyBJ', 'S30EXMZdaD', 'C0xELcXGZl', 'jBUEvPi8k6', 'g5JEQ8OJjY', 'w8BEeToxti', 'blFE3YjHvw', 'bk6EaR73M6', 'mGLEbWkbvx', 'kviEZ1t3M1'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, uiMtnU0RvnAe8rt9o0.cs	High entropy of concatenated method names: 'SkostZdh9p', 'kKQsgP3a3A', 'ct3spOytpW', 'XfVsfRPVme', 'pMdsJe4xjZ', 'IBus7anCC6', 'Weasl2ZAub', 'qobskUowJY', 'WqGsGmhW2a', 'NTqs6gd2eP'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, G3TejlwEAjCaHxvFL9.cs	High entropy of concatenated method names: 'UNw6Tc3QunRnXj1YGGO', 'pJk6sb3BsffCflGPh9R', 'V7EQEbEnKS', 'yNFQAbkZTJ', 'QisQHXeBvP', 'qvBa4K3ZGwP5DcmOxVs', 'JnYrkZ3abNrgVj2jMKj'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, fHwdeZPJfBXj2YfMr4.cs	High entropy of concatenated method names: 'zFjcxy8JJM', 'WdVcUWseZC', 'O5CcXm1wqq', 'lOecLA9og5', 'xfLcvDrmeo', 'Tm7cQbq4hL', 'DAyceRSnQS', 'FD9c3Z7qsC', 'uwxcaXFIpX', 'GbacbSDDv2'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, Iw57mIcu4Uipo3Drfu.cs	High entropy of concatenated method names: 'Dispose', 'kR1PNe6aRi', 'WZeDfj8Ehf', 'nViTT1klWO', 'siwPC0GS6G', 'I2xPz68Bet', 'ProcessDialogKey', 'JqbDW9Cs8M', 'HEXDP5YPAu', 'P6DDDlp8a3'
Source: 0.2.HAhJORNtiOFCEGH.exe.42962c0.6.raw.unpack, JPjDV4GsB2OQCPkt36.cs	High entropy of concatenated method names: 'fMTPe3HgFH', 'eQMP3VG0NE', 'SfhPbsC3ke', 'DtJPZrqPHF', 'NeNPn0dTDu', 'msSPVPAhHA', 'IPCE1gjUsSA4n8swhL', 'DDgXoHdpr7dfRA7x7V', 'BAePPrCfbm', 'gG3PcpOF2r'
Source: 0.2.HAhJORNtiOFCEGH.exe.5990000.10.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: HAhJORNtiOFCEGH.exe PID: 1220, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Memory allocated: 1570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Memory allocated: 4EB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Memory allocated: 64F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Memory allocated: 74F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Memory allocated: 7730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Memory allocated: 8730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: A90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 4680000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2569			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7280			Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe TID: 408	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep count: 36 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -33204139332677172s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2764	Thread sleep count: 2569 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -99797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2764	Thread sleep count: 7280 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -99687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -99555s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -99450s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -99324s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -99093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -98968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -98859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -98750s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -98640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -98531s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -98421s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -98312s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -98203s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -98093s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -97984s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -97874s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -97765s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -97656s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -97546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -97437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -97328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -97218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -97109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -97000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -96890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -96767s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -95282s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -95156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -95046s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -94936s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -94828s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -94655s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -94546s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -94433s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -94327s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -94218s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -94109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -93999s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -93890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -93781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -93671s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -93562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -93453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -93343s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -93234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -93124s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -93015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -92906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 5520	Thread sleep time: -92796s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99555	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99450	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99324	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98750	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98421	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98093	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97874	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 96767	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95282	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94936	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94655	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94546	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94433	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94327	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93671	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93343	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93124	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 92906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 92796	Jump to behavior

Source: MSBuild.exe, 00000002.00000002.3217189090.0000000005A12000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll2

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Queries volume information: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3213980028.00000000026F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2000500638.0000000004B12000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3212849902.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3213980028.0000000002681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HAhJORNtiOFCEGH.exe PID: 1220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1732, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.5990000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.2f17450.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.5990000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.2f17450.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.2ed35b4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.315b5ac.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.315857c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.3159594.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2008352418.0000000005990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1997458410.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1997458410.000000000311E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2000500638.0000000004B12000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3212849902.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3213980028.0000000002681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HAhJORNtiOFCEGH.exe PID: 1220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1732, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.41ee278.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.4228c98.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3213980028.00000000026F9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2000500638.0000000004B12000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3212849902.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3213980028.0000000002681000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: HAhJORNtiOFCEGH.exe PID: 1220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 1732, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.5990000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.2f17450.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.5990000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.2f17450.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.2f067d8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.2ed35b4.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.315b5ac.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.315857c.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.HAhJORNtiOFCEGH.exe.3159594.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2008352418.0000000005990000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1997458410.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1997458410.000000000311E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
HAhJORNtiOFCEGH.exe	61%	ReversingLabs	ByteCode-MSIL.Trojan.SnakeKeyLogger
HAhJORNtiOFCEGH.exe	61%	Virustotal		Browse
HAhJORNtiOFCEGH.exe	100%	Avira	HEUR/AGEN.1305452
HAhJORNtiOFCEGH.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
bg.microsoft.map.fastly.net	0%	Virustotal		Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/03	0%	Avira URL Cloud	safe
http://mail.pu.edu.af	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/03	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
mail.pu.edu.af	103.132.98.224	true	true		unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.o.lencr.org0	MSBuild.exe, 00000002.00000002.3217189090.0000000005A12000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3217189090.0000000005A3A000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://mail.pu.edu.af	MSBuild.exe, 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	HAhJORNtiOFCEGH.exe, 00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp, HAhJORNtiOFCEGH.exe, 00000000.00000002.2000500638.0000000004B12000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3212849902.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	MSBuild.exe, 00000002.00000002.3217189090.0000000005A12000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	MSBuild.exe, 00000002.00000002.3217189090.0000000005A12000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://r3.i.lencr.org/03	MSBuild.exe, 00000002.00000002.3217189090.0000000005A12000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3217189090.0000000005A3A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.132.98.224	mail.pu.edu.af	Afghanistan		58469	MOCI-AS-APMinistryofCommunicationITAF	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436312
Start date and time:	2024-05-04 10:14:33 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	HAhJORNtiOFCEGH.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 75 Number of non-executed functions: 3
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 23.206.229.76, 40.68.123.157, 192.229.211.108, 199.232.210.172, 13.95.31.18, 23.206.229.80, 20.3.187.198
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:15:16	API Interceptor	2x Sleep call for process: HAhJORNtiOFCEGH.exe modified
10:15:19	API Interceptor	61x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.132.98.224	eiQXaKJ75nCjEWn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	MehGCkAdgaX9oF0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	wsst63fXULoBQTw.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	43643456.exe	Get hash	malicious	AgentTesla	Browse	192.229.211.108
	Hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse	192.229.211.108
	LFfjUMuUFU.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, XWorm	Browse	192.229.211.108
	https://lestore.lenovo.com/detail/L109130	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.67rwzb.cn/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://jingxinwl.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://vpassz.xu4nblog.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://rdtetsyutfuyfrxytf.azurewebsites.net/	Get hash	malicious	TechSupportScam	Browse	192.229.211.108
	https://8952627338.z28.web.core.windows.net/?phone=09-70-18-72-82	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://nthturn.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
bg.microsoft.map.fastly.net	eiQXaKJ75nCjEWn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	199.232.210.172
	Zahlungsbeleg 202405029058.vbs	Get hash	malicious	FormBook, GuLoader	Browse	199.232.214.172
	Arrival Notice.pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	199.232.210.172
	Hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse	199.232.210.172
	invoice PDF -2024.gz.vbs	Get hash	malicious	Unknown	Browse	199.232.214.172
	Pedido-Faturado-398731.msi	Get hash	malicious	Unknown	Browse	199.232.214.172
	LFfjUMuUFU.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, XWorm	Browse	199.232.210.172
	https://www.67rwzb.cn/	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://jingxinwl.com/	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://nthturn.com/	Get hash	malicious	Unknown	Browse	199.232.214.172
mail.pu.edu.af	eiQXaKJ75nCjEWn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224
	MehGCkAdgaX9oF0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224
	wsst63fXULoBQTw.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MOCI-AS-APMinistryofCommunicationITAF	eiQXaKJ75nCjEWn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224
	MehGCkAdgaX9oF0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224
	wsst63fXULoBQTw.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	0e46.scr.exe	Get hash	malicious	AgentTesla	Browse	23.1.237.91
	Dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	23.1.237.91
	#U00d6deme tavsiyesi.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	23.1.237.91
	SecuriteInfo.com.Win32.Dropper-CHS.435.30054.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	SecuriteInfo.com.W32.A-62389890.Eldorado.13265.15378.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://xdywna.com/	Get hash	malicious	Unknown	Browse	23.1.237.91
	https://portal.cpscompressors.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	23.1.237.91
	4iVYDe0VaY.dll	Get hash	malicious	Latrodectus	Browse	23.1.237.91
	GLKJoBXIVE.dll	Get hash	malicious	Latrodectus	Browse	23.1.237.91
	MODULO_RIMBORSO_AGENZIA_ENTRATE.PDF.exe	Get hash	malicious	Unknown	Browse	23.1.237.91

Process:	C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.959182119319668
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	HAhJORNtiOFCEGH.exe
File size:	702'464 bytes
MD5:	71188fae17ca6e068158080cd9be278a
SHA1:	1d2aaa378a8543283ab0af492da4351557948eab
SHA256:	1a220cf90de5204b1f33c388537f695421fc1388dd2ed8315efa211d0113ea6e
SHA512:	571b5a00d210bab01a662e7c214e433d930579c0c8669155de2f2a52db344e6d2e25c77e799ddf4eaf59b8da2fa5db0bae5f5f76391adf424fad1411f33d571a
SSDEEP:	12288:O3/T3/fVrTtK3/hLHMhwhvaVE63vsad/n7PaSrgQyuZcQazHxj7mP2Dowf3/a3/:OrXVrTtKZLHM6QacP3jZcPLYODowfC
TLSH:	4CE423C572CE9B18D56F93F6099A890107BA3A4B61B1FD1C5FC85CD17AEBF0A4B50A03
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...^`3f..............0..x...8........... ........@.. ....................................@................................

File Icon


Icon Hash:	0773f1fcfccc6113

Static PE Info

General

Entrypoint:	0x4a96de
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6633605E [Thu May 2 09:43:58 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
aaa
inc edi
aaa
dec eax
xor eax, 42000000h
xor eax, 4E343531h
xor eax, 32414939h
dec ecx
aaa
aaa
inc ebp
xor al, 56h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa968c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x2ce4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xae000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa7704	0xa7800	9587cb4676fe0a15ce01bfccead7e479	False	0.9616021455223881	data	7.977281565173417	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x2ce4	0x3000	50c87540272ab1dd4dfa6c90f186dff4	False	0.87158203125	data	7.429928103608448	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xae000	0xc	0x800	6bbe1175ea1c20d81ea8ca8a0e9e3c15	False	0.01611328125	data	0.03037337037012526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xaa100	0x26cd	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9980871841336958
RT_GROUP_ICON	0xac7e0	0x14	data	1.05
RT_VERSION	0xac804	0x2e0	data	0.4470108695652174
RT_MANIFEST	0xacaf4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 10:15:15.911434889 CEST	49674	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:15.911437988 CEST	49675	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:16.036506891 CEST	49673	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:21.524934053 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:21.961452007 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:21.961564064 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:22.404951096 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:22.408898115 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:22.844288111 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:22.844336987 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:22.844666958 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:23.280175924 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:23.306988001 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:23.745296955 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:23.745359898 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:23.745373011 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:23.745558023 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:25.152754068 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:25.520823002 CEST	49675	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:25.520828962 CEST	49674	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:25.589332104 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:25.602065086 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:25.645940065 CEST	49673	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:26.038556099 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:26.046636105 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:26.482784986 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:26.483638048 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:26.931365013 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:26.931852102 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:27.016160011 CEST	443	49703	23.1.237.91	192.168.2.5
May 4, 2024 10:15:27.016410112 CEST	49703	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:27.369498014 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:27.369779110 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:27.844480991 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:27.848985910 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:27.849215031 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:28.284934998 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:28.284966946 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:28.285942078 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:28.286010027 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:28.286010027 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:28.286010027 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:28.722222090 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:28.722311974 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:28.774641991 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:15:28.817745924 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:15:38.827910900 CEST	49703	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:38.828016043 CEST	49703	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:38.828413963 CEST	49709	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:38.828447104 CEST	443	49709	23.1.237.91	192.168.2.5
May 4, 2024 10:15:38.828517914 CEST	49709	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:38.828772068 CEST	49709	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:38.828792095 CEST	443	49709	23.1.237.91	192.168.2.5
May 4, 2024 10:15:38.987411022 CEST	443	49703	23.1.237.91	192.168.2.5
May 4, 2024 10:15:38.987427950 CEST	443	49703	23.1.237.91	192.168.2.5
May 4, 2024 10:15:39.158883095 CEST	443	49709	23.1.237.91	192.168.2.5
May 4, 2024 10:15:39.159120083 CEST	49709	443	192.168.2.5	23.1.237.91
May 4, 2024 10:15:58.311604977 CEST	443	49709	23.1.237.91	192.168.2.5
May 4, 2024 10:15:58.311683893 CEST	49709	443	192.168.2.5	23.1.237.91
May 4, 2024 10:17:01.599334955 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:17:02.039975882 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:17:02.040122032 CEST	587	49704	103.132.98.224	192.168.2.5
May 4, 2024 10:17:02.040177107 CEST	49704	587	192.168.2.5	103.132.98.224
May 4, 2024 10:17:03.334038973 CEST	49704	587	192.168.2.5	103.132.98.224

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 10:15:20.600383043 CEST	59932	53	192.168.2.5	1.1.1.1
May 4, 2024 10:15:21.507203102 CEST	53	59932	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 4, 2024 10:15:20.600383043 CEST	192.168.2.5	1.1.1.1	0xd833	Standard query (0)	mail.pu.edu.af	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 4, 2024 10:15:21.507203102 CEST	1.1.1.1	192.168.2.5	0xd833	No error (0)	mail.pu.edu.af		103.132.98.224	A (IP address)	IN (0x0001)	false
May 4, 2024 10:15:38.388042927 CEST	1.1.1.1	192.168.2.5	0x802	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 4, 2024 10:15:38.388042927 CEST	1.1.1.1	192.168.2.5	0x802	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 4, 2024 10:15:39.160177946 CEST	1.1.1.1	192.168.2.5	0xf2f4	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 4, 2024 10:15:39.160177946 CEST	1.1.1.1	192.168.2.5	0xf2f4	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 4, 2024 10:15:22.404951096 CEST	587	49704	103.132.98.224	192.168.2.5	220 scloud.andc.gov.af ESMTP Postfix
May 4, 2024 10:15:22.408898115 CEST	49704	587	192.168.2.5	103.132.98.224	EHLO 172892
May 4, 2024 10:15:22.844336987 CEST	587	49704	103.132.98.224	192.168.2.5	250-scloud.andc.gov.af 250-PIPELINING 250-SIZE 204800000 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
May 4, 2024 10:15:22.844666958 CEST	49704	587	192.168.2.5	103.132.98.224	STARTTLS
May 4, 2024 10:15:23.280175924 CEST	587	49704	103.132.98.224	192.168.2.5	220 2.0.0 Ready to start TLS

Target ID:	0
Start time:	10:15:16
Start date:	04/05/2024
Path:	C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\HAhJORNtiOFCEGH.exe"
Imagebase:	0xb70000
File size:	702'464 bytes
MD5 hash:	71188FAE17CA6E068158080CD9BE278A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2008352418.0000000005990000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2000500638.00000000041EE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2000500638.0000000004B12000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2000500638.0000000004B12000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1997458410.0000000002EB1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.1997458410.000000000311E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:15:17
Start date:	04/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x450000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3213980028.00000000026CE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3213980028.00000000026F9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3212849902.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3212849902.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3213980028.0000000002681000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3213980028.0000000002681000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	10.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	231
Total number of Limit Nodes:	8

Executed Functions

Function 0157AE48 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0157B09E

Memory Dump Source

Source File: 00000000.00000002.1997172873.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3b794ebf9b45d0d53e25a82f585e98be76254dc7c6234b979adbd6d9f5d94fb3
Instruction ID: 8ee351cbb7d8648b0903965541bdd460c378e3f1f56f76d3ce979ba8bc09fad7
Opcode Fuzzy Hash: 3b794ebf9b45d0d53e25a82f585e98be76254dc7c6234b979adbd6d9f5d94fb3
Instruction Fuzzy Hash: 3F7135B0A00B058FE725DF2AE44575ABBF5FF88300F048A2DE45ADBA50DB75E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 054B1872 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,054B1396,00000000,?), ref: 054B1A02

Memory Dump Source

Source File: 00000000.00000002.2007971194.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54b0000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c54d7251188e670937abc1e962de03fb4b2bd2b0fd1ba7d3a34cb31636e3ab98
Instruction ID: 057207aa728f7cddba1f648268767fe2310521e25bc40eb4b6421a1f4ba4eca5
Opcode Fuzzy Hash: c54d7251188e670937abc1e962de03fb4b2bd2b0fd1ba7d3a34cb31636e3ab98
Instruction Fuzzy Hash: 4B4127B1D00349DFEF14CFA9C894ADEBBB1BF88300F24915AE419AB211D7B4A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 054B18E7 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,054B1396,00000000,?), ref: 054B1A02

Memory Dump Source

Source File: 00000000.00000002.2007971194.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54b0000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 7074c00342854cb707090d1610b946c2c64b35a6649342baf16e168a280d806d
Instruction ID: 05ec712df1cfda2f6473fb8a0fc55840023f99690af5df6742051cf0357141ed
Opcode Fuzzy Hash: 7074c00342854cb707090d1610b946c2c64b35a6649342baf16e168a280d806d
Instruction Fuzzy Hash: 0851D1B1D00349DFDB14CF99C994ADEBBB5FF48304F24816AE819AB210D7B4A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 054B18F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,054B1396,00000000,?), ref: 054B1A02

Memory Dump Source

Source File: 00000000.00000002.2007971194.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54b0000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 493e9f89fc1b3694d1fb58145276353d1b95062f1c4f780edda37b781be16415
Instruction ID: ae165aeedfb57e4546c1de0113966f684eb12de8431a02b455a55d940c184801
Opcode Fuzzy Hash: 493e9f89fc1b3694d1fb58145276353d1b95062f1c4f780edda37b781be16415
Instruction Fuzzy Hash: 5041D2B1D00349DFDB14CF9AC894ADEBBB5FF48314F24816AE419AB210D7B4A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 054B1850 Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,054B1396,00000000,?), ref: 054B1A02

Memory Dump Source

Source File: 00000000.00000002.2007971194.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54b0000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6796821efac53adea9ff74609b0e0fe7b15ae4af4474c0de8555f277e345a131
Instruction ID: ca9c2a412c1a6b7f846263524f37f750ba9e8dae804862ba862fc357d71e1466
Opcode Fuzzy Hash: 6796821efac53adea9ff74609b0e0fe7b15ae4af4474c0de8555f277e345a131
Instruction Fuzzy Hash: EC4136B1C04349DFEB05CFA9C854ADDBFB1BF49300F24915AE409AB251D7B4A985CF60

Uniqueness

Uniqueness Score: -1.00%

Function 054B1893 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,054B1396,00000000,?), ref: 054B1A02

Memory Dump Source

Source File: 00000000.00000002.2007971194.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54b0000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: f298247b8b3863d75dc6eeedc3d865ab703b382885976ddcff5e6cc22de33bc9
Instruction ID: 2f4840c221461aed1929057babdb340af10b5562edae5f1e26dcd9e07365aee3
Opcode Fuzzy Hash: f298247b8b3863d75dc6eeedc3d865ab703b382885976ddcff5e6cc22de33bc9
Instruction Fuzzy Hash: 874104B1D04349DFEB15CF99C894ADDBFB1BF49300F24916AE409AB250D7B4A985CF60

Uniqueness

Uniqueness Score: -1.00%

Function 054B18D7 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,054B1396,00000000,?), ref: 054B1A02

Memory Dump Source

Source File: 00000000.00000002.2007971194.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54b0000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 580f6b643bb82e32567202230bc9ddafa4fb1185a198201c9018fb3b80c57678
Instruction ID: 6da7146ba231b879435904420ec89991a14dce82c8e54fc0c29f74e3764f5b92
Opcode Fuzzy Hash: 580f6b643bb82e32567202230bc9ddafa4fb1185a198201c9018fb3b80c57678
Instruction Fuzzy Hash: 7541C2B1D00349DFEB14CF99C894ADEBBB1BF48304F24916AE409AB250D7B5A985CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01574508 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 015759E9

Memory Dump Source

Source File: 00000000.00000002.1997172873.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7405a62f2feb622c254c17d60de57286dc5cecc4ed5d4826afdc7d443fe802fb
Instruction ID: 4c7cf0989221eff753008787691bcbb4b84f71bdb14dac2c8855607dfc3f5a27
Opcode Fuzzy Hash: 7405a62f2feb622c254c17d60de57286dc5cecc4ed5d4826afdc7d443fe802fb
Instruction Fuzzy Hash: 7B41D2B0C00719CBDB25DFA9C885BDDBBF5BF49304F20806AD408AB255DBB56946CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0157592D Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 015759E9

Memory Dump Source

Source File: 00000000.00000002.1997172873.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 02b11aef339a8b23f6d62856f03c4bb30a438f20b40ae0753df85daa68fb1580
Instruction ID: 66a98bb1819d6591d9b4b3bc2e26dda075da88b346cd2abc748d87fd35a86267
Opcode Fuzzy Hash: 02b11aef339a8b23f6d62856f03c4bb30a438f20b40ae0753df85daa68fb1580
Instruction Fuzzy Hash: 5341F2B1C00719CEDB25DFA9C885BDDBBF1BF49304F24806AD418AB251DBB5694ACF90

Uniqueness

Uniqueness Score: -1.00%

Function 054B4050 Relevance: 1.6, APIs: 1, Instructions: 93COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 054B4111

Memory Dump Source

Source File: 00000000.00000002.2007971194.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54b0000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 4a3c3f0eed8e48d043e869e75224db32daa577334935122c873f0e102f309b01
Instruction ID: 438f23ff814f39e5eb0774413e0b86890d2cd91ce34f0793073e74777f6e6930
Opcode Fuzzy Hash: 4a3c3f0eed8e48d043e869e75224db32daa577334935122c873f0e102f309b01
Instruction Fuzzy Hash: 3741F9B9900315DFDB14CF99C448AEABBF6FB88314F24C499D519AB321D775A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0157D07C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0157D6EE,?,?,?,?,?), ref: 0157D7AF

Memory Dump Source

Source File: 00000000.00000002.1997172873.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a0408523a0e4646249f0193c0d7dff65c5136ba7360354a4945cc197f6224d10
Instruction ID: 797158d05e8d752a4ded79c18a9bac36bd6c84bf17dbba0cdb6b6da651c26520
Opcode Fuzzy Hash: a0408523a0e4646249f0193c0d7dff65c5136ba7360354a4945cc197f6224d10
Instruction Fuzzy Hash: AF21E3B59002489FDB10CF9AD985AEEFBF9FF48310F14845AE918A7310D379A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0157D720 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0157D6EE,?,?,?,?,?), ref: 0157D7AF

Memory Dump Source

Source File: 00000000.00000002.1997172873.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c64782dcd9fdbb4e0d3c99dddd99fbb1700438569107ca2a2e63489c44a75488
Instruction ID: 06be85e4df4799aee9700e2e51b22a16c69e790779f15f3c694d4bf52682fc89
Opcode Fuzzy Hash: c64782dcd9fdbb4e0d3c99dddd99fbb1700438569107ca2a2e63489c44a75488
Instruction Fuzzy Hash: 2E21E3B59002489FDB10CF9AD985AEEFBF9FF48310F14841AE918A7310D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 054B1450 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,054B1396,00000000,?), ref: 054B1A02

Memory Dump Source

Source File: 00000000.00000002.2007971194.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54b0000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a85d66ecb0e3905023cfeeecc12911f1dca94a415aa0e7a757c5ae2ae17de96a
Instruction ID: 12b9d8301cfdbef1c0432ce4a50a94a729b873991682c0a1bb82d060330ba2bb
Opcode Fuzzy Hash: a85d66ecb0e3905023cfeeecc12911f1dca94a415aa0e7a757c5ae2ae17de96a
Instruction Fuzzy Hash: 862118B1800248EFEF14DF98C898ADDBBB5BF09344F208149E9086B260C7B5A855CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0157A228 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0157B119,00000800,00000000,00000000), ref: 0157B72A

Memory Dump Source

Source File: 00000000.00000002.1997172873.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d231297a1eee3868afd72cedccdccfb068cd8b7fccb5bb83209bdfcc42540d78
Instruction ID: 00967490daa7fd3dbddcad5727769ecd95760746183a64b54b37dea0a8c96c18
Opcode Fuzzy Hash: d231297a1eee3868afd72cedccdccfb068cd8b7fccb5bb83209bdfcc42540d78
Instruction Fuzzy Hash: B911F6B69003499FDB20DF9AD448AEEFBF8FF48310F14846AD519AB210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0157B6BA Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0157B119,00000800,00000000,00000000), ref: 0157B72A

Memory Dump Source

Source File: 00000000.00000002.1997172873.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d9bd9e1ed2898921332852ae19a1a83b56a9c6037a579719ba44b824af97e9c5
Instruction ID: f2392124ed0bcb806bcb88a4c7fc28e26967682ca0fc45ae949e5c59c21214b2
Opcode Fuzzy Hash: d9bd9e1ed2898921332852ae19a1a83b56a9c6037a579719ba44b824af97e9c5
Instruction Fuzzy Hash: 861126B69003489FDB10CF9AD444ADEFBF8FB48310F14841AD519A7200C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0157B038 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0157B09E

Memory Dump Source

Source File: 00000000.00000002.1997172873.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e4da77a18dc306bdddf49a2edee7bcf4930a42835ceff326ac0305cae428610e
Instruction ID: e508c0502f6113eb2b0b03d08335426031a811f6dc852e69ff50cba08c9e9293
Opcode Fuzzy Hash: e4da77a18dc306bdddf49a2edee7bcf4930a42835ceff326ac0305cae428610e
Instruction Fuzzy Hash: 6D11DFB6C002498FDB20DF9AD844ADEFBF8BB88314F10845AD929A7610D379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0150D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1996991888.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5da59aabfa0369d8a1d217dff77927ee57ec66dbbcb9e9fd6caaacdb15b86f4e
Instruction ID: 50bc3dce7937587be4705b737cd552dd244ef1ca0df2df4d3362e6cb787e26b3
Opcode Fuzzy Hash: 5da59aabfa0369d8a1d217dff77927ee57ec66dbbcb9e9fd6caaacdb15b86f4e
Instruction Fuzzy Hash: 9B21A172504245DFDB06DFD8D9C4B2ABFB5FB88324F24C569E9090E296C33AD416CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0151D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997029941.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_151d000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60f95e4d975a64025b7c983283a2b3d3b59670c4f65ae697d406c3a0e3eee77c
Instruction ID: a6ce31b287f4962b3eaca3161b437a26e1fb858544ff0b6999af9515d0c51504
Opcode Fuzzy Hash: 60f95e4d975a64025b7c983283a2b3d3b59670c4f65ae697d406c3a0e3eee77c
Instruction Fuzzy Hash: 22210771504204DFEB06DF98D5C8F66BBB5FB84324F20CA6DD9294F25AC33AD446CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0151D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997029941.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_151d000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3d8894ba2421052a775d14d521b86f14545d483fe9092039f27997abb72bd76
Instruction ID: 1f2d1e0af0ffb964f8cff9f85f9953e0b2902d064f035dec5dce9fe1b38c73c6
Opcode Fuzzy Hash: d3d8894ba2421052a775d14d521b86f14545d483fe9092039f27997abb72bd76
Instruction Fuzzy Hash: CF210375504204DFEB16DF68D988B26BFB5FB84314F20C96DD9090F25AD33AD446CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0151D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997029941.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_151d000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74adbec24daf1041e8fe4d7629611e7dcdebe6b149f2e72fd3f2811438c51432
Instruction ID: 41e4d80a901b819dd96333724b1a64bee03f274cef51692df03c2369c1844ac8
Opcode Fuzzy Hash: 74adbec24daf1041e8fe4d7629611e7dcdebe6b149f2e72fd3f2811438c51432
Instruction Fuzzy Hash: AA219D755093808FDB03CF24D994B15BF71FB46214F28C5EAD8498F2A7C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0150D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1996991888.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction ID: 0e9af823da777da3f19d57a6e7c06c5ee138a4aa5389fb33bb434ca5da0733de
Opcode Fuzzy Hash: d06fae078f3ccc2112caf8552f6b645ede566e603d6c7b0d9faf10800b04cc1c
Instruction Fuzzy Hash: DE219076504241DFDB06CF94D9C4B1ABF71FB84324F24C5A9DD450A656C33AD426CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0151D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997029941.000000000151D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0151D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_151d000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction ID: 38a5ad38b9443de53a3a032421fb7fdf7a5c30c5661afd96db8e4155a3f36de8
Opcode Fuzzy Hash: 945d3a080ad63b5e32bcc5b18ec1e97d0272151c1fb78e482730898ede984437
Instruction Fuzzy Hash: F711BB75504280DFEB02CF58C5C8B19BFB1FB84224F24C6A9D8594F69AC33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0150D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1996991888.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d761b79071701514ad8a85a03aad382cc9f84daf9161d78104f46d2600dc57f4
Instruction ID: 2976a33572b38eaa218b53e2f5b3fc9bfb1938b0a8db7e3e48c939a107800cca
Opcode Fuzzy Hash: d761b79071701514ad8a85a03aad382cc9f84daf9161d78104f46d2600dc57f4
Instruction Fuzzy Hash: 7301AC7110438499E7229AD9CD84B66BFECFF45324F14C969ED090E2D6D2799441CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0150D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1996991888.000000000150D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0150D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_150d000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 435dcf365b1540ea247d94221ad013a7568c6e51bf811dfd0165f3cc21f2c0c9
Instruction ID: 41df0b3c46998957a11f240b0afcf0f6b7f6e86bf337f3a223b454ac0c4607fb
Opcode Fuzzy Hash: 435dcf365b1540ea247d94221ad013a7568c6e51bf811dfd0165f3cc21f2c0c9
Instruction Fuzzy Hash: 8FF0C2710043849AE7218E9ACC88B66FFA8EF81634F18C45AED080E286C2799844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 054B0040 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007971194.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54b0000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f7d3112526d828191ae14dd0a18baa0ca11d087bdb78d3d094af5ee3a505d30
Instruction ID: 4d1f45760e4bc7fc22314fb1fbe1eaa0587f572eed5c430ddf7c994b5f93fa1f
Opcode Fuzzy Hash: 4f7d3112526d828191ae14dd0a18baa0ca11d087bdb78d3d094af5ee3a505d30
Instruction Fuzzy Hash: 3612A5B8C817468BD710CF65F84C1893BF1BBA1318BD04B19D2612B3E5DBB51A6ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 0157EFC4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1997172873.0000000001570000.00000040.00000800.00020000.00000000.sdmp, Offset: 01570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1570000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77138d94e3d18ed892e9b4e9541d956bbfb7cff24ca198c090fd0b14bf04d5e9
Instruction ID: bbd7a655143f6e584a125ba590240f6469164a799a4dd92d54e54d24de8b6b9a
Opcode Fuzzy Hash: 77138d94e3d18ed892e9b4e9541d956bbfb7cff24ca198c090fd0b14bf04d5e9
Instruction Fuzzy Hash: E3A17E36E00216CFCF06DFB8D4445AEBBB2FF85300B15856AE916AF265DB71E916CB40

Uniqueness

Uniqueness Score: -1.00%

Function 054B0006 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2007971194.00000000054B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 054B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_54b0000_HAhJORNtiOFCEGH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fe8114547e3bffbfec9eb9f343577b56123341bc7aa53205e6f68136da331d6
Instruction ID: 7918abfe76dcee7813cae2af399d9254beae3dd552afdc8a09dd5b406968c9d9
Opcode Fuzzy Hash: 5fe8114547e3bffbfec9eb9f343577b56123341bc7aa53205e6f68136da331d6
Instruction Fuzzy Hash: FAD134B8C807468BD711CF25F8481897BF1BFA1328F954B19D1616B3E1DBB819AACF44

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 1732, Parent PID: 1220COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	25
Total number of Limit Nodes:	4

Executed Functions

Function 00A99BE8 Relevance: 3.0, Instructions: 3022COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1285b36d13a4836494f480b3b923a1e1c2f4e2366f20f054ab0712aa2994a055
Instruction ID: 0c0d23aa0d61ef8f20f3c4c3fafa2c55a803ed56f059038e704ab21688c32073
Opcode Fuzzy Hash: 1285b36d13a4836494f480b3b923a1e1c2f4e2366f20f054ab0712aa2994a055
Instruction Fuzzy Hash: 57631831D10B1A8ADB11EF68C8946A9F7B1FF99310F15C79AE05877121EB70AAD4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00A9CE70 Relevance: 2.3, Instructions: 2315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e634191c720391f86b61f7ae376f8c7f1e6bbb7764595faf88a6d6bd0d9b1b3
Instruction ID: aef3ca7a7e4ce7a2af92ed970893a9eb130495c54c91048a681c2d7f9254d7bc
Opcode Fuzzy Hash: 4e634191c720391f86b61f7ae376f8c7f1e6bbb7764595faf88a6d6bd0d9b1b3
Instruction Fuzzy Hash: 48331D31D107198ECB11EF68C8906ADF7B1FF99300F15C79AE459A7221EB70AAD5CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00A99370 Relevance: .6, Instructions: 577COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d06efcbd55bec2cdfc29f4854e4f00392e47c6a5ec75ba9e7db34ffb3e84a5
Instruction ID: 1717511bd2ee6a96464671961701e4a827737765521df9f30850b45247c37849
Opcode Fuzzy Hash: f9d06efcbd55bec2cdfc29f4854e4f00392e47c6a5ec75ba9e7db34ffb3e84a5
Instruction Fuzzy Hash: 8E224935B002059FDF14DFA8E984AAEBBB2EF89310F148569E909DB395DB30DC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A94A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a70103d5a1d60c40b82b0fa0b85da11dac8b2a2c3bf3e35377bc49c3cfc7076
Instruction ID: 16e7e6b5fd9c579b8023efe44d0551a454532ad94fb0f4e7435d087b1984f27d
Opcode Fuzzy Hash: 3a70103d5a1d60c40b82b0fa0b85da11dac8b2a2c3bf3e35377bc49c3cfc7076
Instruction Fuzzy Hash: A7B13E74F002098FDF14CFA9C985B9DBBF2AF8C354F148529D419E7254EB749846CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00A93E80 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41dc4d7d5e7b1bb16d4f3f39f6a6983321dea7c20a257d0ab9bd9ac89f21203a
Instruction ID: 25689aebb0c07cef779aef5f35b76191f636f2c862d2f95b0a0722cb26678a09
Opcode Fuzzy Hash: 41dc4d7d5e7b1bb16d4f3f39f6a6983321dea7c20a257d0ab9bd9ac89f21203a
Instruction Fuzzy Hash: A7912F71F00209DFDF14CFA9C985BDDBBF2AF88314F248129E415AB254EB749986CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A96EDD Relevance: 2.6, Strings: 2, Instructions: 143
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR]q, xrefs: 00A96F06
LR]q, xrefs: 00A96FF4

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID: LR]q$LR]q
API String ID: 0-3917262905
Opcode ID: 1588bd86b59aa7dd231e44abbd1cec02dbc2b16d0efde5a39e8ec564f5253f97
Instruction ID: 5c251a114d7c1685b7c02e7fef4750917e4ae8b8e9dc1024846a2263b12a956d
Opcode Fuzzy Hash: 1588bd86b59aa7dd231e44abbd1cec02dbc2b16d0efde5a39e8ec564f5253f97
Instruction Fuzzy Hash: 1D417D30B142059FDF15DB78D4547AEBBF2EF8A300F208569E406EB251DB759C46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05B4E198 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3217688859.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a3755f76a39f385d33360533f886627da91331b6d685959ba2e3a4dce88d3e8
Instruction ID: adf6134690c5775d7b61a8ad6e3eef332cbbfac2c5babda9ec8692fdc43b36df
Opcode Fuzzy Hash: 4a3755f76a39f385d33360533f886627da91331b6d685959ba2e3a4dce88d3e8
Instruction Fuzzy Hash: 81410372E143558FCB14CFB9E8447AEBBF5FF89210F1485AAD408A7240DB78A944CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 05B4E280 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(8B55052F), ref: 05B4E2E7

Memory Dump Source

Source File: 00000002.00000002.3217688859.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5b40000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 1a6472b42f0814eb8084a10392d7575948a753dc4f39f1b9abcc9543dbd60913
Instruction ID: 0932a8abf36a1ed643e4fc71ef09538dfab60e2194f63bfbafab6b4c2c01432e
Opcode Fuzzy Hash: 1a6472b42f0814eb8084a10392d7575948a753dc4f39f1b9abcc9543dbd60913
Instruction Fuzzy Hash: 7D11E4B1C006599BCB10DF9AC544BDEFBF4FF48310F14816AD418A7240D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A9F3AD Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

PH]q, xrefs: 00A9F4FB

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: ed866e90b5d1702f61c1cd32702bfb5c124eb61e1b2efb756080fbc672e67c57
Instruction ID: e329882e502e10e1d70154e395c055c5a1f52955087b670f428587219b9ff4be
Opcode Fuzzy Hash: ed866e90b5d1702f61c1cd32702bfb5c124eb61e1b2efb756080fbc672e67c57
Instruction Fuzzy Hash: 94319D30B042058FDB199B34D9A476E3BE2AFCA744F258479D406DB399EE35CC46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A9F3C0 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

PH]q, xrefs: 00A9F4FB

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID: PH]q
API String ID: 0-3168235125
Opcode ID: 585adae7d8d15f77bff60c09fe187e9168907fbbd3847a019a9a06074a5e217e
Instruction ID: d456ee1c6a10e162002954400958ebdc6dbaba34e4176636882947c8a9029947
Opcode Fuzzy Hash: 585adae7d8d15f77bff60c09fe187e9168907fbbd3847a019a9a06074a5e217e
Instruction Fuzzy Hash: 1531AB30B002058FDF19AB38956476F7BE6ABC9704F248478D406DB399DE35DC46CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00A96F70 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00A96FF4

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: f28bd737eb88d72a4a634108657b8bb90cbf7ac14baf810a5a658071ab167d25
Instruction ID: ac38a024c262d42e2919cd54b8b53222db5fb1f58996b0fdf1e86ded0ba9d140
Opcode Fuzzy Hash: f28bd737eb88d72a4a634108657b8bb90cbf7ac14baf810a5a658071ab167d25
Instruction Fuzzy Hash: 6F314D30F102099BDF14CFA8D8547AEB7F2EF85310F208569E806EB250EB75AD46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A96B87 Relevance: 1.3, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00A96BCF

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 76acc95a058f3f145a0b87910afb6b950554afe840f93c0a753a0ac07ca80091
Instruction ID: 8c48fe479d9f2c881e42ba42908b36dd8c7aef2951824304eada5958b292a340
Opcode Fuzzy Hash: 76acc95a058f3f145a0b87910afb6b950554afe840f93c0a753a0ac07ca80091
Instruction Fuzzy Hash: 8221D83170D2805FC716EB7894A479E7FF29F86310F0445AED085CB396DA695C4AC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00A97908 Relevance: .6, Instructions: 553COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5189079902bcc8015af0eabbc43f4253acfe4e2d544f56a1d46d736c59a02492
Instruction ID: 90cc4301b5d5e7f4a752cbea97208eed07ad626aacb9b45975a95240f7b82cc7
Opcode Fuzzy Hash: 5189079902bcc8015af0eabbc43f4253acfe4e2d544f56a1d46d736c59a02492
Instruction Fuzzy Hash: AE1260347102019BCB29AB78E89462D73A6FFCA351F548979E006CB369DF75DC46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00A94A8C Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca378329d2888469008f4d6e78674e800e5c9bc6c5d3bc7e676d64d96a332e26
Instruction ID: 7636b45e0279c0603aae6d9b56d09f2dbe5945c4681be9eb6921a5e59a63809d
Opcode Fuzzy Hash: ca378329d2888469008f4d6e78674e800e5c9bc6c5d3bc7e676d64d96a332e26
Instruction Fuzzy Hash: 17B13A70E002199FDF14CFA9C985B9DBBF1BF8C354F248129D819EB254EB749886CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00A9935C Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bcd2b6c7c658dedb47036abfe0211d3a77f1311c7da81e6ffd0689a6117e88c
Instruction ID: 5d1285f2893c84aeecab0cb1a7b78da0a7947c65b77e7e471bce8d38bdce6a9a
Opcode Fuzzy Hash: 7bcd2b6c7c658dedb47036abfe0211d3a77f1311c7da81e6ffd0689a6117e88c
Instruction Fuzzy Hash: CAA13A34B002049FCB15DF68E594AAEBBF6EF89310F248469E506EB3A5DB34DC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A93E74 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3b598b93eb3b8d03dc58548cf0dd52802d136e1f91db34fce9e677ee0810b60
Instruction ID: 0fd8bbedce0f41980fd9933fa3a9a422b14b086b3fda6683b66e35652cc80e92
Opcode Fuzzy Hash: a3b598b93eb3b8d03dc58548cf0dd52802d136e1f91db34fce9e677ee0810b60
Instruction Fuzzy Hash: E5913C71F00209DFDF14CFA9C985BDDBBF1AF88314F248129E419AB254EB749986CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A94805 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89f1b36650dc00c4f8b1cb764d5bf25ee00c771289adf72581001bfecfa620e2
Instruction ID: 9c93fcffc70dbc58d4c2106a9a6f83ca7cbac32f92c0b5c6dd780add53c7622f
Opcode Fuzzy Hash: 89f1b36650dc00c4f8b1cb764d5bf25ee00c771289adf72581001bfecfa620e2
Instruction Fuzzy Hash: 02714DB0E00249DFDF10DFA9C985BDEBBF2BF88314F148129E415A7254EB749846CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00A94810 Relevance: .2, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9f12ea96092708bef2f1b7ae16e0abe9fba934e98aa0fa5af9027ba22fab42
Instruction ID: 722b4f83c8c420fb0c7ec9c1c272e6ea7864717dc2f9908920e348af41bfd776
Opcode Fuzzy Hash: ab9f12ea96092708bef2f1b7ae16e0abe9fba934e98aa0fa5af9027ba22fab42
Instruction Fuzzy Hash: 3F716AB0E00249DFDF10DFA9C981B9EBBF2BF88314F148129E419A7254EB749842CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00A96CD4 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d21bd24b04f4e49e28da7eb6ed192efacbb0772e370d2d428f1d7f9ba4fa9a2f
Instruction ID: 5419e2694466a98c55334e68733d1244ac51f90d3b8bf1050c8878aefebfccc7
Opcode Fuzzy Hash: d21bd24b04f4e49e28da7eb6ed192efacbb0772e370d2d428f1d7f9ba4fa9a2f
Instruction Fuzzy Hash: 4A51F174E102188FDF18CFA9C889B9DBBF1FF49314F14812AE819AB295D774A844CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00A96CE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ff28f3b4c624975a6c20ed67cdcbc33256e3ca1154c615bccb62529ecd0b5d
Instruction ID: ca4ee5bf1b818db1aeb6e09f8131f2e554430177d60f43cbd714905b8954c9ca
Opcode Fuzzy Hash: 56ff28f3b4c624975a6c20ed67cdcbc33256e3ca1154c615bccb62529ecd0b5d
Instruction Fuzzy Hash: 6F51F274E102188FDF18CFA9C885B9DBBF1BF48314F14852AE819AB391D778A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00A926DC Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 523c054281d78063113ba8c17bed5c13c9577e2300686850749429bf919b945b
Instruction ID: 7537cbe68527d8b43bf4dbf090f997b0f5bbac7d6addf6c4ff981fb4d4888a6d
Opcode Fuzzy Hash: 523c054281d78063113ba8c17bed5c13c9577e2300686850749429bf919b945b
Instruction Fuzzy Hash: 9051F0B0E003099FDB14DFAAC484BDEBBF5FF48314F24842AE419AB250DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A91128 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32efb67244e509c04083d26cacbc5d3eb98e3cb5c222dec1a8d59d08b08e843f
Instruction ID: eae11bcf5348e7014297c2314d0c9ddc26f0a270560e642224eccb3f88b98751
Opcode Fuzzy Hash: 32efb67244e509c04083d26cacbc5d3eb98e3cb5c222dec1a8d59d08b08e843f
Instruction Fuzzy Hash: 5D51FC38216141EFCB1AEF28F9B0E453FA5FB6EB047106B69D0015B23EDB256909EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00A91138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44fc7e1f07e56c230a2d8211575d0d389254dc0df3ce1080934bd357d79bdaf7
Instruction ID: 62b2a867f4a39e2688eeca3b9c81eeaf897769e7a1944957b7f4aebd8befad9a
Opcode Fuzzy Hash: 44fc7e1f07e56c230a2d8211575d0d389254dc0df3ce1080934bd357d79bdaf7
Instruction Fuzzy Hash: 4C51DA78216141EFCB19EF28F9B0E453FA5FB6EB043106B69D0015B23DDB216909EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00A996D8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1a6a68b272d4850ea703887cdaf711df7210e652fd2f1e65a5af7a0e93f940
Instruction ID: 56c0e8b365ba60dd10aaf748ce579b7f4baeb77bea2243d74bae62ae1c451ad4
Opcode Fuzzy Hash: 1c1a6a68b272d4850ea703887cdaf711df7210e652fd2f1e65a5af7a0e93f940
Instruction Fuzzy Hash: D7313E75F1020AABDF249FADD58076FB7A5FB86310F20482ED51ADB384DA34DC458B92

Uniqueness

Uniqueness Score: -1.00%

Function 00A9F270 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20f58d3c86eb1d6259ce39615a50af3825a1ef3975f93c4cd3108ad22d6164f6
Instruction ID: 91672516cc6d1f220a3b098b814ef023e8bffc02c58044f1675bde5684f72926
Opcode Fuzzy Hash: 20f58d3c86eb1d6259ce39615a50af3825a1ef3975f93c4cd3108ad22d6164f6
Instruction Fuzzy Hash: D6315E35F146059FCB09CFA4D89469EBBF2AF89314F108529E816EB350DB74AC46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A9F280 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70ae665a691fad38d171f74e711e8ede4b61a3f69e81c0e84a6d615b96374868
Instruction ID: c305ac783f387f4915b5e40d9530954203c5da22e850428435a2654b97d45938
Opcode Fuzzy Hash: 70ae665a691fad38d171f74e711e8ede4b61a3f69e81c0e84a6d615b96374868
Instruction Fuzzy Hash: 85314B35F102059FCB19CFA9E89469EBBF2AF89314F108529E816EB350DB74AC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00A926E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d1c0de4a8c3a8e43f86e7b94da033080b4abbbc1c3b4c7b8a8046b823452fb4
Instruction ID: 88a23fd7bcc0578f420b9e176cc92f6f1b3e40e4a508fae697a598a147930ef0
Opcode Fuzzy Hash: 6d1c0de4a8c3a8e43f86e7b94da033080b4abbbc1c3b4c7b8a8046b823452fb4
Instruction Fuzzy Hash: 0B41DEB0E00349AFDB14DFA9C584ADEBFF5FF48314F248429E809AB254DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00A91488 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5368de958c650c357517b737fddaaf74c801b76d9669022990042a4cd6ca2546
Instruction ID: e441a989aa51e705571c7a5ea50256316148ca78681796d1c0f15dc7ffad69ef
Opcode Fuzzy Hash: 5368de958c650c357517b737fddaaf74c801b76d9669022990042a4cd6ca2546
Instruction Fuzzy Hash: C021B0B1F053529FCF22ABB899942AD7BE0EF8A350F1544BAD446DB342E735C841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A99248 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d6930f36ecc1d58d9f11b41880be4fea2173f4a3338f286650031d2029819f
Instruction ID: 27a14228ce11d2c46e6b3ec234f3c4394603b00c3a43d847b739592f999530ad
Opcode Fuzzy Hash: 39d6930f36ecc1d58d9f11b41880be4fea2173f4a3338f286650031d2029819f
Instruction Fuzzy Hash: DB315035E1020AABDF09CFA8D5946DEB7B6BF89300F10C629E405EB354DB709846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A917C0 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467fad1b95b10c1514157206ec6105b643d9eed763aaae4afc979aee49802f94
Instruction ID: 124eb15ba489fc0d75029daf3a5f8dd9e25270e5ecaae69d6108f9f29a8ed18c
Opcode Fuzzy Hash: 467fad1b95b10c1514157206ec6105b643d9eed763aaae4afc979aee49802f94
Instruction Fuzzy Hash: A7213776F043429FEF219BB89C04A9E7BE5AB59320F144A65ED49C3354E734CC01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0094D006 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213156978.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c2bca81df1d5091901ef9eef906011e2d5e8d44fbe4b7fcf285b29d2447f64c
Instruction ID: f95a92627b2ff13cbc80290df466d33146e9df2c04198a1b978d83290f9d7bf3
Opcode Fuzzy Hash: 4c2bca81df1d5091901ef9eef906011e2d5e8d44fbe4b7fcf285b29d2447f64c
Instruction Fuzzy Hash: 08316F7550E3C49FC7138B24C894B11BF75AB57214F29C5DBD9898F2A3C23A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00A99258 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d7ee623cff6d8087fb8049b9b55a13f08f6fbd5aa85e7772af21613abc69a81
Instruction ID: f12b32519951d54ff8786dbeb8aa8344bbb12439c960f8bea0190fcf625447a7
Opcode Fuzzy Hash: 0d7ee623cff6d8087fb8049b9b55a13f08f6fbd5aa85e7772af21613abc69a81
Instruction Fuzzy Hash: EC215331E10209ABDF05CFA9D4846DFF7B6BF89300F508629E405AB244DB719C46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A94F88 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c09f5ac39a117968bba7c4fbb469e49ffe1292df694482cc774cf4a0e2e83033
Instruction ID: 8f476ae0ff882104edb4903b1e9237ff278a389e0fed3488c59f82fe63d9482b
Opcode Fuzzy Hash: c09f5ac39a117968bba7c4fbb469e49ffe1292df694482cc774cf4a0e2e83033
Instruction Fuzzy Hash: E621F730B00205CFCB54DB79D969A9D77F1EF8E315B1004A8E406EB3A5DB369D05DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A99148 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4a6a4ac6b291314b56e37c7bec60656623f3c319814cf5eeb1a3b81469ee90
Instruction ID: bc98877617809818f9f8372d548cd8457e0746d9325c1f5a1685405632321a95
Opcode Fuzzy Hash: 8e4a6a4ac6b291314b56e37c7bec60656623f3c319814cf5eeb1a3b81469ee90
Instruction Fuzzy Hash: 82216235F04206ABDF19CFA9D8545DEF7F2AF89310F20862AE815AB354DB709D42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0094D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213156978.000000000094D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0094D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_94d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58a4f34545abb4533348fe1a248606e8a46cb1313a918e6fc5e87e761821b40b
Instruction ID: 1641adb98b4e3b2db35d3db0e40bd8f573bf3390da2b784f4cfb2dd02093bf23
Opcode Fuzzy Hash: 58a4f34545abb4533348fe1a248606e8a46cb1313a918e6fc5e87e761821b40b
Instruction Fuzzy Hash: 5A210479605204DFCB15DF14D9C0F26BBA9FB88314F24C96DE9094B296C37AD847CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00A99A20 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f69dac21bf83b71a875ed4769beb0a08bb6c4e9364537a130ebe66c7097e76
Instruction ID: 9e203b603141544ab2402da96efd01d2125b542577e6f6ccbeee82f8380f282f
Opcode Fuzzy Hash: b3f69dac21bf83b71a875ed4769beb0a08bb6c4e9364537a130ebe66c7097e76
Instruction Fuzzy Hash: 17218E31B10215AFDB04DB69C955BAE7BF6FB88750F208069E505EB3A0DA719C018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00A99158 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab500dd7834c1124ae8d1483b473d34e5d968fab9d1172d335ab2aaadf534ee
Instruction ID: 8d77a4d6784dbc86d5bfda25fe6351acd5badcdda4c36a85f0f9dbb26c282a7d
Opcode Fuzzy Hash: 7ab500dd7834c1124ae8d1483b473d34e5d968fab9d1172d335ab2aaadf534ee
Instruction Fuzzy Hash: 00212F31F1020AABDF19CF69D85459EF7F6AF89310F20862AE815B7350DB709D45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A916AD Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f302ff209ef0fc6dfd2fbc524e748e2b4dade61eb2f4010332b7cd25ed3a8
Instruction ID: c0773dd75fd08c645d48ad2391fad86368b770c68c85257d4451ad789fc1130c
Opcode Fuzzy Hash: 877f302ff209ef0fc6dfd2fbc524e748e2b4dade61eb2f4010332b7cd25ed3a8
Instruction Fuzzy Hash: B121513C7001026FDF26EB68FC84B5937A9EB49714F205A25D40ACB36DDB68DC458B92

Uniqueness

Uniqueness Score: -1.00%

Function 00A91888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb869ff00776fc60a5bc77c1073281e1ada77e462a0986b482c31d7a0ba0f12a
Instruction ID: 8b8ad787579333139847209440b0209c2e2d43aa28fbb550695cfb9607ce72bf
Opcode Fuzzy Hash: fb869ff00776fc60a5bc77c1073281e1ada77e462a0986b482c31d7a0ba0f12a
Instruction Fuzzy Hash: 1F213C30B0020ACFDF54EB78C5657AE77F6AB49305F200468D506EB3A4DB369D45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A9138B Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40f3c266c40c2cc3a7d004a3ebbf5e0499d8844786b5837774b17be80fbab2ce
Instruction ID: ac216e64b3bffb8669f51a8124a9177faeb1f3fb5ae257c071d05e24bdcc626e
Opcode Fuzzy Hash: 40f3c266c40c2cc3a7d004a3ebbf5e0499d8844786b5837774b17be80fbab2ce
Instruction Fuzzy Hash: F521B9747112029BEF355734E98872E36E5EB4B315F100975E407CB394DA29CC80C792

Uniqueness

Uniqueness Score: -1.00%

Function 00A916B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce4d0488edf3e68abee95514ec66c8d918f6b8d095cbf463912e275fd9e6c47
Instruction ID: 53123996dd67afcecc0a1a49704d62bf3e88f89738c2b43f34b0fab9b462f7ed
Opcode Fuzzy Hash: 4ce4d0488edf3e68abee95514ec66c8d918f6b8d095cbf463912e275fd9e6c47
Instruction Fuzzy Hash: 4E2151387001026FDF16EB68F884B1937A9EB49714F205A25D40ACB36DDB68DC458B92

Uniqueness

Uniqueness Score: -1.00%

Function 00A91885 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 472e792a6cff5adb1f6ef2e51750004cf8a1fcfdf811f188fcc1fc274cdc4763
Instruction ID: 2fd8620a6e4498555daecb168159ce0a39291c83ff5085a465dacd2f20c041a1
Opcode Fuzzy Hash: 472e792a6cff5adb1f6ef2e51750004cf8a1fcfdf811f188fcc1fc274cdc4763
Instruction Fuzzy Hash: 33213830B00216CFDF25EB78C6657AE77F2AB89305F200468D406EB3A4DB368D45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A94F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a785548320dd772ea255783512ada2ee74f43c9cb0c20eb42dab91d7a9dffd9
Instruction ID: f669bedb17ebd9245f7e84e3085418a8b926abb331f80adfc4782eece32a6467
Opcode Fuzzy Hash: 4a785548320dd772ea255783512ada2ee74f43c9cb0c20eb42dab91d7a9dffd9
Instruction Fuzzy Hash: 9721E434B10205CFCB54EB79C969AAE77F1AB8D305F200568E406EB3A4EB369D01CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00A90838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f578c1ea034215fdde39cafe3a8707335f8c71920ce318bf4e09dd7432aee21f
Instruction ID: a93038ecaeda0e9f3dc43c0b20e21b98f1d5165aeca7239a51f3f7708e573d1b
Opcode Fuzzy Hash: f578c1ea034215fdde39cafe3a8707335f8c71920ce318bf4e09dd7432aee21f
Instruction Fuzzy Hash: A2110630B053148FEF6567B89850F7A37E0EB92390F20C97AC042CF286DA24CC418BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00A90848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91c249269b71dcfe03c2e713722c32685912d60b7fff929a3a5032fcc8b7b6de
Instruction ID: 92b25c672700db29f9e5b30c62d1785ae10698c8a4e1f4a9a659d605fe178b1b
Opcode Fuzzy Hash: 91c249269b71dcfe03c2e713722c32685912d60b7fff929a3a5032fcc8b7b6de
Instruction Fuzzy Hash: 3B119134B002149FEF696B79D850B2A37E5EB96394F20C939D146CB355DA25CC818BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00A91498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d52ab7a49fc2c0379a970a87c7a407659dfcdecec07cd92f5befe9da1b737de6
Instruction ID: befef3bb517a2ef5f1be6087ffb370158987e588100cbb45a56a9619a8e41560
Opcode Fuzzy Hash: d52ab7a49fc2c0379a970a87c7a407659dfcdecec07cd92f5befe9da1b737de6
Instruction Fuzzy Hash: 1E014071B002169FCF65EFB885916AE7BF5EF88350B25047AD806E7301EB35C9418BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00A99888 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eaa52d485d67ee5b08e2fc7d7462b992e938d90bc4efcea3d73617ee5379c63
Instruction ID: 71e2d57f1595b4481be8acb98447fb0e59703037f93ace7c47bac9434077016e
Opcode Fuzzy Hash: 9eaa52d485d67ee5b08e2fc7d7462b992e938d90bc4efcea3d73617ee5379c63
Instruction Fuzzy Hash: F4017931A001048FCB14DF99E985B8BBBA5FF85310F54C574D8485B29AD774DD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A99A6F Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68543ebddc75bb8fce2ed57609a72f730bcf5e02a04aff97dfda1e610f241e8b
Instruction ID: af19f2df7f59c9924d5441c8048a9447aa628ac99bd3a6d901864719d83519ac
Opcode Fuzzy Hash: 68543ebddc75bb8fce2ed57609a72f730bcf5e02a04aff97dfda1e610f241e8b
Instruction Fuzzy Hash: 59014471B00105AFDB009BADCA58BAE7BF1FF88765F258199E106EB7A5CA31DC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A980E8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1146ac015aed73c407d542d9cf3b89595a147e04e63906f3e45ef01811f51b67
Instruction ID: 8d6ca6ac0258f0f86b3a84f5534a349ab2eb6257a86e725149ddda945634c110
Opcode Fuzzy Hash: 1146ac015aed73c407d542d9cf3b89595a147e04e63906f3e45ef01811f51b67
Instruction Fuzzy Hash: A2017C34941209EFCB06EFB8F990A8D7FB5EF84300F5052B9C0059B269DB355A09CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00A97088 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d57b8af18bc903b2db944c0226a81378277ef85b9fd14cf649ba350b6df08501
Instruction ID: aba9d54ce03863f8394e66f92b8d42513e2ec5580ed82eec055855ec27346c7b
Opcode Fuzzy Hash: d57b8af18bc903b2db944c0226a81378277ef85b9fd14cf649ba350b6df08501
Instruction Fuzzy Hash: C1F01435B002188FCB14EB64D9A8B6C73B2EF89315F1044A8E506CB3A0CB35AD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00A980F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3213676672.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a90000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 968b2d68cfb71335b1a5c458a2d9e08825ed7c78f7ce94c4de5522df30313052
Instruction ID: e4015473006dd45078fc453f6e16a28f28f13745c098b02f7defc779ffc375bb
Opcode Fuzzy Hash: 968b2d68cfb71335b1a5c458a2d9e08825ed7c78f7ce94c4de5522df30313052
Instruction Fuzzy Hash: BEF03134940209EFCB05FFB8F991A9D7BB9EF84304F505678C0049B259DB316E09CB92

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report HAhJORNtiOFCEGH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HAhJORNtiOFCEGH.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
HAhJORNtiOFCEGH.exe

Function 0157AE48 Relevance: 1.7, APIs: 1, Instructions: 199
COMMON

Function 054B1872 Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Function 054B18E7 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Function 054B18F0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Function 054B1850 Relevance: 1.6, APIs: 1, Instructions: 107
COMMON

Function 054B1893 Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Function 054B18D7 Relevance: 1.6, APIs: 1, Instructions: 103
COMMON

Function 01574508 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00A96EDD Relevance: 2.6, Strings: 2, Instructions: 143
COMMON

Function 05B4E198 Relevance: 1.6, APIs: 1, Instructions: 133
COMMON

Function 05B4E280 Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre