Edit tour

Windows Analysis Report
xoRN6fxApwT8Kin.exe

Overview

General Information

Sample name:	xoRN6fxApwT8Kin.exe
Analysis ID:	1436313
MD5:	5f051c2e92d5356803e765524197cf06
SHA1:	76b88dec039bade499a7bd0f95e7c9c1f1508d45
SHA256:	4ba45a9624e8fc73cf5a36e7be9966f01ada829dd88491202baff3b0bce9b6f5
Tags:	exe
Infos:

Detection

AgentTesla, PureLog Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: MSBuild connects to smtp port

Yara detected AgentTesla

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Contains functionality to log keystrokes (.Net Source)

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

xoRN6fxApwT8Kin.exe (PID: 2812 cmdline: "C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe" MD5: 5F051C2E92D5356803E765524197CF06)

MSBuild.exe (PID: 5988 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.pu.edu.af", "Username": "saif.rohi@pu.edu.af", "Password": "Ro#@.com55"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.3312406521.00000000028D9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2104726295.0000000005020000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000002.3311154081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3311154081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2103132118.000000000444F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2103132118.000000000444F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.2098586390.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000000.00000002.2098586390.0000000002A5E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: xoRN6fxApwT8Kin.exe PID: 2812	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xoRN6fxApwT8Kin.exe PID: 2812	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: MSBuild.exe PID: 5988	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 5988	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.xoRN6fxApwT8Kin.exe.5020000.10.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.28467f4.1.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.285746c.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.5020000.10.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.285746c.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.28467f4.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31725:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31841:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3191d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a43:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.MSBuild.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33525:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33641:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3371d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33843:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31725:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31841:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3191d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a43:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.xoRN6fxApwT8Kin.exe.28135d0.4.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33525:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33641:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3371d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33843:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334b3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6ded3:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33525:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df45:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335af:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6dfcf:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33641:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e061:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ab:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e0cb:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3371d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e13d:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337b3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e1d3:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33843:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e263:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.xoRN6fxApwT8Kin.exe.2a995c8.2.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.2a985b0.3.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
0.2.xoRN6fxApwT8Kin.exe.2a9b5e0.5.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
Click to see the 22 entries

Sigma Signatures

Networking

Sigma detected: MSBuild connects to smtp port

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 103.132.98.224, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 5988, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49699

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.pu.edu.af", "Username": "saif.rohi@pu.edu.af", "Password": "Ro#@.com55"}

Multi AV Scanner detection for submitted file

Source: xoRN6fxApwT8Kin.exe	ReversingLabs: Detection: 57%
Source: xoRN6fxApwT8Kin.exe	Virustotal: Detection: 64%			Perma Link

Machine Learning detection for sample

Source: xoRN6fxApwT8Kin.exe

Joe Sandbox ML: detected

Source: xoRN6fxApwT8Kin.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: xoRN6fxApwT8Kin.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, type: UNPACKEDPE

Source: global traffic

TCP traffic: 192.168.2.6:49699 -> 103.132.98.224:587

Source: global traffic

TCP traffic: 192.168.2.6:49699 -> 103.132.98.224:587

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: mail.pu.edu.af

Source: MSBuild.exe, 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.pu.edu.af
Source: MSBuild.exe, 00000002.00000002.3315400430.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311671980.0000000000C0F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311389172.0000000000B88000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3315400430.0000000005C27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/03
Source: MSBuild.exe, 00000002.00000002.3315400430.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311671980.0000000000C0F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311389172.0000000000B88000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3315400430.0000000005C27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: MSBuild.exe, 00000002.00000002.3311671980.0000000000C47000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311671980.0000000000C0F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311389172.0000000000B88000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3315400430.0000000005C27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: MSBuild.exe, 00000002.00000002.3311671980.0000000000C47000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311671980.0000000000C0F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311389172.0000000000B88000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3315400430.0000000005C27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: xoRN6fxApwT8Kin.exe, 00000000.00000002.2103132118.000000000444F000.00000004.00000800.00020000.00000000.sdmp, xoRN6fxApwT8Kin.exe, 00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311154081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, lBLTBzkV.cs	.Net Code: h9f
Source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack, lBLTBzkV.cs	.Net Code: h9f

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Code function: 0_2_00D04B20	0_2_00D04B20
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Code function: 0_2_00D0EFC4	0_2_00D0EFC4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00D69370	2_2_00D69370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00D64A98	2_2_00D64A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00D69BE8	2_2_00D69BE8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00D63E80	2_2_00D63E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00D6CE70	2_2_00D6CE70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00D641C8	2_2_00D641C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05D1DD10	2_2_05D1DD10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05D1BCF0	2_2_05D1BCF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05D13F48	2_2_05D13F48
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05D156D8	2_2_05D156D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05D10040	2_2_05D10040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05D18B98	2_2_05D18B98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05D12AF0	2_2_05D12AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05D14FF8	2_2_05D14FF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_05D13248	2_2_05D13248
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00D6D76F	2_2_00D6D76F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 2_2_00D69BE0	2_2_00D69BE0

Source: xoRN6fxApwT8Kin.exe	Binary or memory string: OriginalFilename vs xoRN6fxApwT8Kin.exe
Source: xoRN6fxApwT8Kin.exe, 00000000.00000002.2105043466.0000000005C80000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs xoRN6fxApwT8Kin.exe
Source: xoRN6fxApwT8Kin.exe, 00000000.00000002.2104546131.0000000004E20000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs xoRN6fxApwT8Kin.exe
Source: xoRN6fxApwT8Kin.exe, 00000000.00000002.2095444763.00000000009CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs xoRN6fxApwT8Kin.exe
Source: xoRN6fxApwT8Kin.exe, 00000000.00000000.2060243395.00000000004BA000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBwnU.exe8 vs xoRN6fxApwT8Kin.exe
Source: xoRN6fxApwT8Kin.exe, 00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0eb1f663-67ab-4af7-95d7-b04526baf746.exe4 vs xoRN6fxApwT8Kin.exe
Source: xoRN6fxApwT8Kin.exe, 00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs xoRN6fxApwT8Kin.exe
Source: xoRN6fxApwT8Kin.exe, 00000000.00000002.2098586390.00000000027F1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSimpleLogin.dllD vs xoRN6fxApwT8Kin.exe
Source: xoRN6fxApwT8Kin.exe, 00000000.00000002.2098586390.00000000028D5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename0eb1f663-67ab-4af7-95d7-b04526baf746.exe4 vs xoRN6fxApwT8Kin.exe
Source: xoRN6fxApwT8Kin.exe	Binary or memory string: OriginalFilenameBwnU.exe8 vs xoRN6fxApwT8Kin.exe

Source: xoRN6fxApwT8Kin.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: xoRN6fxApwT8Kin.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, kGWv.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, 84Zwl.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, Z80kh.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, R7VqEELv.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, iWM.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, tHB.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, YGTyRx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, YGTyRx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, YGTyRx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, YGTyRx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, PhxrgbBjgH8t6U3oB0.cs	Security API names: _0020.SetAccessControl
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, PhxrgbBjgH8t6U3oB0.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, PhxrgbBjgH8t6U3oB0.cs	Security API names: _0020.AddAccessRule
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, zfVtiBZNGOifsVnveL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, PhxrgbBjgH8t6U3oB0.cs	Security API names: _0020.SetAccessControl
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, PhxrgbBjgH8t6U3oB0.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, PhxrgbBjgH8t6U3oB0.cs	Security API names: _0020.AddAccessRule
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, zfVtiBZNGOifsVnveL.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: 0.2.xoRN6fxApwT8Kin.exe.285746c.0.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.xoRN6fxApwT8Kin.exe.28467f4.1.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.xoRN6fxApwT8Kin.exe.5020000.10.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.winEXE@3/1@1/1

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xoRN6fxApwT8Kin.exe.log

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Mutant created: \Sessions\1\BaseNamedObjects\ICfdlS

Source: xoRN6fxApwT8Kin.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: xoRN6fxApwT8Kin.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xoRN6fxApwT8Kin.exe	ReversingLabs: Detection: 57%
Source: xoRN6fxApwT8Kin.exe	Virustotal: Detection: 64%

Source: unknown	Process created: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe "C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe"
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: xoRN6fxApwT8Kin.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: xoRN6fxApwT8Kin.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.xoRN6fxApwT8Kin.exe.5020000.10.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.xoRN6fxApwT8Kin.exe.285746c.0.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})
Source: 0.2.xoRN6fxApwT8Kin.exe.28467f4.1.raw.unpack, XG.cs	.Net Code: Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777298)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777243)),Type.GetTypeFromHandle(global::cO.Ri.k2anMS(16777254))})

.NET source code contains potential unpacker

Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, PhxrgbBjgH8t6U3oB0.cs	.Net Code: jC7bXHPjTevFtSniwxA System.Reflection.Assembly.Load(byte[])
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, PhxrgbBjgH8t6U3oB0.cs	.Net Code: jC7bXHPjTevFtSniwxA System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe

Code function: 0_2_04E25781 push ss; retf

0_2_04E25783

Source: xoRN6fxApwT8Kin.exe

Static PE information: section name: .text entropy: 7.977880616762822

Source: 0.2.xoRN6fxApwT8Kin.exe.5020000.10.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.xoRN6fxApwT8Kin.exe.285746c.0.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, PBhwNVc1V9U1vwoMuXf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'rcX7W5UVLg', 'N217o3PIwn', 'HdX7HZi9KA', 'MbV7RfPe0f', 'SJZ7juuDio', 'z1C7k90Ig7', 'afd7ERfV07'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, wmI290itSkRspP2Yhn.cs	High entropy of concatenated method names: 'TAslNyVnbM', 'thElIJakN4', 'CjFlbkoOrM', 'aTKlnTjudH', 'fRklGAytYk', 'BUIlpbEtnN', 'NkAl8VX35i', 'oHileHUNsy', 'la8lwrBgVW', 'HkMlDO2nj4'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, Ex94nwvge3GJhhVmbc.cs	High entropy of concatenated method names: 'fhAxRkh4V', 'yOFshk4Lb', 'Krc590b8K', 'kk5cDmc5n', 'nBjrX694u', 'B4UfGxwhN', 'feBiBGU355cwMmQx7W', 'CHr29x4uFZVq02yE5u', 'FyUlZjO7L', 'r0N7KUh8x'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, JLCalwryhRFlCDjQyW.cs	High entropy of concatenated method names: 'vxIn4a3GBh', 'K19ncRUb85', 'L1QbC6fJd7', 'VvUbqPfdel', 'aLKbURM7Df', 'cSpb36drJA', 'TXnbAu67Mu', 'tVpb0oE9V2', 'ugcbVwXPe5', 'BfRbtEsFxV'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, xkKOvtV16DQsu6LDgD.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'dQTYg5SdwU', 'NsoYQiq8mo', 'VnJYzTryus', 'vP6uLwVOQ8', 'j1fuMRaOsJ', 'd7OuYSbgZ7', 'RX2uup3lAM', 'Gw4KrbPcqf04KmVAYTs'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, T2PEnHuBfJpOQMBfmJ.cs	High entropy of concatenated method names: 'wB1vOnfbdQ', 'tLovrDukRK', 'ShqvJnpPmG', 'LBxvToOtts', 'XPDvqVa737', 'puJvUnL47l', 'dYIvAgL546', 'KoAv0KovSJ', 'T56vtdoCJb', 'Q2wv9Lm9VZ'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, IbRghTnpjW608ZEDMI.cs	High entropy of concatenated method names: 'tqxBwmjhpx', 'l1FBDI2SrH', 'ToString', 'IGMBN1vFmZ', 'MhXBIcTuG5', 'ASfBb4At9Q', 'QW6Bnf3PCq', 'JHyBGQgtjf', 'qL4BpIOS3u', 'lTWB8sm6yd'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, PhxrgbBjgH8t6U3oB0.cs	High entropy of concatenated method names: 'nhqu621wVN', 'J3cuNIIUdD', 'bE4uI2m7VA', 'f8GubCMsjL', 'P74unNJmdq', 'PFduGCADNi', 'jOIupluhEM', 'Vlbu8CBMZW', 'ynnueyQAdL', 'yhouwYkpjM'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, i6WVtTkkVQifLFZw2W.cs	High entropy of concatenated method names: 'ToString', 'Yubh91j19C', 'EpAhTm0nyw', 'CKehCIo1AT', 'GOWhqHL4ei', 'FxqhU2yfcD', 'S3ih3FhQGO', 'w5qhAWKY1h', 'UE4h0PQfiB', 'j2thVMtjmC'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, F4hZbHIRtlvIOY278j.cs	High entropy of concatenated method names: 'UDEbsrF6Ne', 'N7ub5OcFoH', 'HIZbOJxeFB', 'DcUbr6FIte', 'wHKbZhUKs3', 'pgfbhxQs3E', 'aLgbBVuNbb', 'FYeblffFXk', 'lPVbXxHOEG', 'iqib7qYV1O'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, yrFM9xaiufxYM9vcvO.cs	High entropy of concatenated method names: 'MmfZtig6Ba', 'NN4Zmw8Z7m', 'Lr1ZWDmSkT', 'BwPZoO0NUe', 'nuOZTyw2Cj', 'LD1ZCmrGex', 'n68ZqFrSXL', 'uNCZU0rtKF', 'iqXZ3GsdBa', 'iH7ZARPPhg'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, nY9Wqx9kXbIx7vhLQ9.cs	High entropy of concatenated method names: 'q6MB2oPiop', 'Bc8BQehA7F', 'TKSlL2RBhU', 'iT3lMhj0lL', 'rPTB95GYGa', 'jfuBmYgXG7', 'mLcBaCnXUu', 'hLlBW7w8Im', 'UjyBobd4Fc', 'qtcBHr3aIe'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, hk16jxKdareY1Imsea.cs	High entropy of concatenated method names: 'tFBpyLZIId', 'Aolpd1nwkC', 'RTQpxX2bGQ', 'Cv0pscspJG', 'j6Ep4tPCnS', 'ilrp5m6iyv', 'FMupch0DhP', 'yuopOkE26E', 'RL3prcgbLh', 'b0Mpfukhre'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, roiSL6x9axwDcmrZST.cs	High entropy of concatenated method names: 'm5dMpg0CKh', 'cdfM8H50Lv', 'vDrMw2uFwX', 'zD6MD6cQ5U', 'GdnMZuRiXA', 'bEaMh6Pkgv', 't1aPtLRbXJU5A2sRv2', 'EwPlwrML6CkIo7H7S9', 'UZhMMbNfo9', 'lMSMuV47bf'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, QhNQxfeLxuRmB2u6w5.cs	High entropy of concatenated method names: 'GoyXM4sUZJ', 'hvMXuqkRo4', 'jgLXiGfubN', 'saoXNVC5bp', 'SdSXIOMCWp', 'Gl0XnU4AaG', 'MOKXGef6Yx', 'HoKlErfxuB', 'pFWl2F1guS', 'PHElg9Wykc'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, AwxyZC3hnFHSFpYLVL.cs	High entropy of concatenated method names: 'WOPlJOVZ6O', 'BTFlTScbUu', 'HLBlCwoKi3', 'ruVlqZCBEw', 'qIqlW4w08u', 'auVlUJgkuo', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, G4T3nQhqVr1NI20gXQ.cs	High entropy of concatenated method names: 'Dispose', 'Ug9MgW5C1w', 'qgBYTTJYG8', 'VX9PPtQpqI', 'pF8MQ0Dwmf', 'kiQMzaK8mf', 'ProcessDialogKey', 'mqdYL3O9QQ', 'oheYMW6hW9', 'QsLYYo5cGa'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, zfVtiBZNGOifsVnveL.cs	High entropy of concatenated method names: 't4CIWNKtkI', 'lctIoTCEbr', 'd48IHUxX2I', 'eCnIRmL6VK', 'aWuIjBPYrH', 'RncIk9W0S4', 'aveIEmhkhA', 'zDeI296hgc', 'ckMIgIUI0c', 'CxdIQi7Aon'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, MmPFy7DM8Rnw9OAZjp.cs	High entropy of concatenated method names: 'TAfG6EBlSk', 'eY8GIqG7GP', 'HCiGnhF3in', 'j0aGpZUZZR', 'bDQG8utF9D', 'rBnnjIWpGQ', 'U1enkt73L3', 'T6wnEh64Nb', 'L9Tn280JvP', 'CT0ngF0t3B'
Source: 0.2.xoRN6fxApwT8Kin.exe.5c80000.11.raw.unpack, FHPpFmcjefnK1AXRLoY.cs	High entropy of concatenated method names: 'NfcXyyXX2c', 'LI0Xdp1tuB', 'wuFXxfxxmI', 'BNdXs9lwjr', 'ACpX4l6UGu', 'CLuX5uXJMS', 'irOXc3FvNR', 'TLfXOnIa6X', 'rQSXrZGAHi', 'YeCXfpkQFg'
Source: 0.2.xoRN6fxApwT8Kin.exe.28467f4.1.raw.unpack, XG.cs	High entropy of concatenated method names: 'S1d', 'RgtTUJcyZL', 'n1Q', 'M1r', 'Y1a', 'U1m', 'k2an4M', 'gt', 'kU', 'rK'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, PBhwNVc1V9U1vwoMuXf.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'rcX7W5UVLg', 'N217o3PIwn', 'HdX7HZi9KA', 'MbV7RfPe0f', 'SJZ7juuDio', 'z1C7k90Ig7', 'afd7ERfV07'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, wmI290itSkRspP2Yhn.cs	High entropy of concatenated method names: 'TAslNyVnbM', 'thElIJakN4', 'CjFlbkoOrM', 'aTKlnTjudH', 'fRklGAytYk', 'BUIlpbEtnN', 'NkAl8VX35i', 'oHileHUNsy', 'la8lwrBgVW', 'HkMlDO2nj4'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, Ex94nwvge3GJhhVmbc.cs	High entropy of concatenated method names: 'fhAxRkh4V', 'yOFshk4Lb', 'Krc590b8K', 'kk5cDmc5n', 'nBjrX694u', 'B4UfGxwhN', 'feBiBGU355cwMmQx7W', 'CHr29x4uFZVq02yE5u', 'FyUlZjO7L', 'r0N7KUh8x'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, JLCalwryhRFlCDjQyW.cs	High entropy of concatenated method names: 'vxIn4a3GBh', 'K19ncRUb85', 'L1QbC6fJd7', 'VvUbqPfdel', 'aLKbURM7Df', 'cSpb36drJA', 'TXnbAu67Mu', 'tVpb0oE9V2', 'ugcbVwXPe5', 'BfRbtEsFxV'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, xkKOvtV16DQsu6LDgD.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'dQTYg5SdwU', 'NsoYQiq8mo', 'VnJYzTryus', 'vP6uLwVOQ8', 'j1fuMRaOsJ', 'd7OuYSbgZ7', 'RX2uup3lAM', 'Gw4KrbPcqf04KmVAYTs'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, T2PEnHuBfJpOQMBfmJ.cs	High entropy of concatenated method names: 'wB1vOnfbdQ', 'tLovrDukRK', 'ShqvJnpPmG', 'LBxvToOtts', 'XPDvqVa737', 'puJvUnL47l', 'dYIvAgL546', 'KoAv0KovSJ', 'T56vtdoCJb', 'Q2wv9Lm9VZ'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, IbRghTnpjW608ZEDMI.cs	High entropy of concatenated method names: 'tqxBwmjhpx', 'l1FBDI2SrH', 'ToString', 'IGMBN1vFmZ', 'MhXBIcTuG5', 'ASfBb4At9Q', 'QW6Bnf3PCq', 'JHyBGQgtjf', 'qL4BpIOS3u', 'lTWB8sm6yd'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, PhxrgbBjgH8t6U3oB0.cs	High entropy of concatenated method names: 'nhqu621wVN', 'J3cuNIIUdD', 'bE4uI2m7VA', 'f8GubCMsjL', 'P74unNJmdq', 'PFduGCADNi', 'jOIupluhEM', 'Vlbu8CBMZW', 'ynnueyQAdL', 'yhouwYkpjM'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, i6WVtTkkVQifLFZw2W.cs	High entropy of concatenated method names: 'ToString', 'Yubh91j19C', 'EpAhTm0nyw', 'CKehCIo1AT', 'GOWhqHL4ei', 'FxqhU2yfcD', 'S3ih3FhQGO', 'w5qhAWKY1h', 'UE4h0PQfiB', 'j2thVMtjmC'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, F4hZbHIRtlvIOY278j.cs	High entropy of concatenated method names: 'UDEbsrF6Ne', 'N7ub5OcFoH', 'HIZbOJxeFB', 'DcUbr6FIte', 'wHKbZhUKs3', 'pgfbhxQs3E', 'aLgbBVuNbb', 'FYeblffFXk', 'lPVbXxHOEG', 'iqib7qYV1O'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, yrFM9xaiufxYM9vcvO.cs	High entropy of concatenated method names: 'MmfZtig6Ba', 'NN4Zmw8Z7m', 'Lr1ZWDmSkT', 'BwPZoO0NUe', 'nuOZTyw2Cj', 'LD1ZCmrGex', 'n68ZqFrSXL', 'uNCZU0rtKF', 'iqXZ3GsdBa', 'iH7ZARPPhg'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, nY9Wqx9kXbIx7vhLQ9.cs	High entropy of concatenated method names: 'q6MB2oPiop', 'Bc8BQehA7F', 'TKSlL2RBhU', 'iT3lMhj0lL', 'rPTB95GYGa', 'jfuBmYgXG7', 'mLcBaCnXUu', 'hLlBW7w8Im', 'UjyBobd4Fc', 'qtcBHr3aIe'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, hk16jxKdareY1Imsea.cs	High entropy of concatenated method names: 'tFBpyLZIId', 'Aolpd1nwkC', 'RTQpxX2bGQ', 'Cv0pscspJG', 'j6Ep4tPCnS', 'ilrp5m6iyv', 'FMupch0DhP', 'yuopOkE26E', 'RL3prcgbLh', 'b0Mpfukhre'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, roiSL6x9axwDcmrZST.cs	High entropy of concatenated method names: 'm5dMpg0CKh', 'cdfM8H50Lv', 'vDrMw2uFwX', 'zD6MD6cQ5U', 'GdnMZuRiXA', 'bEaMh6Pkgv', 't1aPtLRbXJU5A2sRv2', 'EwPlwrML6CkIo7H7S9', 'UZhMMbNfo9', 'lMSMuV47bf'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, QhNQxfeLxuRmB2u6w5.cs	High entropy of concatenated method names: 'GoyXM4sUZJ', 'hvMXuqkRo4', 'jgLXiGfubN', 'saoXNVC5bp', 'SdSXIOMCWp', 'Gl0XnU4AaG', 'MOKXGef6Yx', 'HoKlErfxuB', 'pFWl2F1guS', 'PHElg9Wykc'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, AwxyZC3hnFHSFpYLVL.cs	High entropy of concatenated method names: 'WOPlJOVZ6O', 'BTFlTScbUu', 'HLBlCwoKi3', 'ruVlqZCBEw', 'qIqlW4w08u', 'auVlUJgkuo', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, G4T3nQhqVr1NI20gXQ.cs	High entropy of concatenated method names: 'Dispose', 'Ug9MgW5C1w', 'qgBYTTJYG8', 'VX9PPtQpqI', 'pF8MQ0Dwmf', 'kiQMzaK8mf', 'ProcessDialogKey', 'mqdYL3O9QQ', 'oheYMW6hW9', 'QsLYYo5cGa'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, zfVtiBZNGOifsVnveL.cs	High entropy of concatenated method names: 't4CIWNKtkI', 'lctIoTCEbr', 'd48IHUxX2I', 'eCnIRmL6VK', 'aWuIjBPYrH', 'RncIk9W0S4', 'aveIEmhkhA', 'zDeI296hgc', 'ckMIgIUI0c', 'CxdIQi7Aon'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, MmPFy7DM8Rnw9OAZjp.cs	High entropy of concatenated method names: 'TAfG6EBlSk', 'eY8GIqG7GP', 'HCiGnhF3in', 'j0aGpZUZZR', 'bDQG8utF9D', 'rBnnjIWpGQ', 'U1enkt73L3', 'T6wnEh64Nb', 'L9Tn280JvP', 'CT0ngF0t3B'
Source: 0.2.xoRN6fxApwT8Kin.exe.3bd30d0.7.raw.unpack, FHPpFmcjefnK1AXRLoY.cs	High entropy of concatenated method names: 'NfcXyyXX2c', 'LI0Xdp1tuB', 'wuFXxfxxmI', 'BNdXs9lwjr', 'ACpX4l6UGu', 'CLuX5uXJMS', 'irOXc3FvNR', 'TLfXOnIa6X', 'rQSXrZGAHi', 'YeCXfpkQFg'

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Memory allocated: D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Memory allocated: 27F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Memory allocated: 47F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Memory allocated: 5D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Memory allocated: 6D00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Memory allocated: 6F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Memory allocated: 7F40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2860000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 27A0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2689			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7159			Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe TID: 5432	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1460	Thread sleep count: 2689 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -99725s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1460	Thread sleep count: 7159 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -99609s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -99500s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -99390s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -99281s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -99171s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -99062s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -98953s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -98843s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -98734s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -98624s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -98515s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -98406s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -98296s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -98187s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -98078s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -97968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -97859s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -97749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -97639s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -97518s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -95973s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -95854s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -95749s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -95640s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -95530s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -95415s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -95308s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -95189s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -95074s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -94968s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -94812s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -94687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -94577s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -94468s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -94359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -94249s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -94140s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -94031s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -93920s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -93810s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -93702s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -93592s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -93484s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -93374s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -93265s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -93156s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -93046s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -92937s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1824	Thread sleep time: -92828s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99725	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 99062	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98843	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98624	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98515	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98296	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 98078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97639	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 97518	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95973	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95854	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95749	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95530	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95415	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95308	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95189	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 95074	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94968	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94577	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94468	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94249	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94140	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 94031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93920	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93810	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93702	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93592	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93374	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93265	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 93046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 92937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 92828	Jump to behavior

Source: MSBuild.exe, 00000002.00000002.3315400430.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"

Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Queries volume information: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3312406521.00000000028D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3311154081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2103132118.000000000444F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xoRN6fxApwT8Kin.exe PID: 2812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5988, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.5020000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.28467f4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.285746c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.5020000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.285746c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.28467f4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.28135d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.2a995c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.2a985b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.2a9b5e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2104726295.0000000005020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2098586390.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2098586390.0000000002A5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3311154081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2103132118.000000000444F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xoRN6fxApwT8Kin.exe PID: 2812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5988, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b67c68.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.3b2d248.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.3312406521.00000000028D9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3311154081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2103132118.000000000444F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xoRN6fxApwT8Kin.exe PID: 2812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 5988, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.5020000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.28467f4.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.285746c.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.5020000.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.285746c.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.28467f4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.28135d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.2a995c8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.2a985b0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xoRN6fxApwT8Kin.exe.2a9b5e0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2104726295.0000000005020000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2098586390.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2098586390.0000000002A5E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	2 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	12 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	1 Process Discovery	Remote Desktop Protocol	1 Input Capture	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	1 Credentials in Registry	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	11 Archive Collected Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	2 Data from Local System	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	22 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xoRN6fxApwT8Kin.exe	58%	ReversingLabs	Win32.Spyware.Negasteal
xoRN6fxApwT8Kin.exe	65%	Virustotal		Browse
xoRN6fxApwT8Kin.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://mail.pu.edu.af	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/03	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/03	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.pu.edu.af	103.132.98.224	true	true		unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	0%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.o.lencr.org0	MSBuild.exe, 00000002.00000002.3315400430.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311671980.0000000000C0F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311389172.0000000000B88000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3315400430.0000000005C27000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.pu.edu.af	MSBuild.exe, 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	xoRN6fxApwT8Kin.exe, 00000000.00000002.2103132118.000000000444F000.00000004.00000800.00020000.00000000.sdmp, xoRN6fxApwT8Kin.exe, 00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311154081.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	MSBuild.exe, 00000002.00000002.3311671980.0000000000C47000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311671980.0000000000C0F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311389172.0000000000B88000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3315400430.0000000005C27000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	MSBuild.exe, 00000002.00000002.3311671980.0000000000C47000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311671980.0000000000C0F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311389172.0000000000B88000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3315400430.0000000005C27000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://r3.i.lencr.org/03	MSBuild.exe, 00000002.00000002.3315400430.0000000005BE0000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311671980.0000000000C0F000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3311389172.0000000000B88000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000002.00000002.3315400430.0000000005C27000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.132.98.224	mail.pu.edu.af	Afghanistan		58469	MOCI-AS-APMinistryofCommunicationITAF	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436313
Start date and time:	2024-05-04 10:15:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xoRN6fxApwT8Kin.exe
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.winEXE@3/1@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 72 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 20.114.59.183, 23.206.229.80, 23.206.229.76, 192.229.211.108, 52.165.164.15, 13.85.23.206, 52.165.165.26
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:16:02	API Interceptor	2x Sleep call for process: xoRN6fxApwT8Kin.exe modified
10:16:06	API Interceptor	62x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
103.132.98.224	HAhJORNtiOFCEGH.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	eiQXaKJ75nCjEWn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	MehGCkAdgaX9oF0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	wsst63fXULoBQTw.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	HAhJORNtiOFCEGH.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	192.229.211.108
	43643456.exe	Get hash	malicious	AgentTesla	Browse	192.229.211.108
	Hesaphareketi-01.exe	Get hash	malicious	AgentTesla	Browse	192.229.211.108
	LFfjUMuUFU.exe	Get hash	malicious	AsyncRAT, PureLog Stealer, XWorm	Browse	192.229.211.108
	https://lestore.lenovo.com/detail/L109130	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://www.67rwzb.cn/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://jingxinwl.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://vpassz.xu4nblog.com/	Get hash	malicious	Unknown	Browse	192.229.211.108
	https://rdtetsyutfuyfrxytf.azurewebsites.net/	Get hash	malicious	TechSupportScam	Browse	192.229.211.108
	https://8952627338.z28.web.core.windows.net/?phone=09-70-18-72-82	Get hash	malicious	Unknown	Browse	192.229.211.108
mail.pu.edu.af	HAhJORNtiOFCEGH.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224
	eiQXaKJ75nCjEWn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224
	MehGCkAdgaX9oF0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224
	wsst63fXULoBQTw.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MOCI-AS-APMinistryofCommunicationITAF	HAhJORNtiOFCEGH.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224
	eiQXaKJ75nCjEWn.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224
	MehGCkAdgaX9oF0.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224
	wsst63fXULoBQTw.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	103.132.98.224

Process:	C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.959551307417164
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	xoRN6fxApwT8Kin.exe
File size:	698'368 bytes
MD5:	5f051c2e92d5356803e765524197cf06
SHA1:	76b88dec039bade499a7bd0f95e7c9c1f1508d45
SHA256:	4ba45a9624e8fc73cf5a36e7be9966f01ada829dd88491202baff3b0bce9b6f5
SHA512:	22b11adc57fbcea6a4af09ceff55db572cc8b973c05f31754d952a4eed6969081e658cab20cda78912a9e632c12652b3dfc66f53e11f3d750c8fd588a814d2a8
SSDEEP:	12288:H3/T3/fVrTtK3/I1ijxmtq9ICp/gls875z4fD/HRtkDqwAXYbVE/Tr5TR803/K3/:HrXVrTtKAowtq9FcGtkDqwjorVRhy
TLSH:	41E4234462EDEB1ED13FC3F42E0A4B400776BB1E6512EA4D1ED135C51DEAB4A8B50367
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....a3f..............0..h...8......~.... ........@.. ....................................@................................

File Icon


Icon Hash:	0773f1fcfccc6113

Static PE Info

General

Entrypoint:	0x4a867e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6633611C [Thu May 2 09:47:08 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
aaa
inc edi
aaa
dec eax
xor eax, 42000000h
xor eax, 4E343531h
xor eax, 32414939h
dec ecx
aaa
aaa
inc ebp
xor al, 56h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa862c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xaa000	0x2ce4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xae000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa66a4	0xa6800	bd716af570a43038fb96bfbea311c7f7	False	0.9612439588025525	data	7.977880616762822	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xaa000	0x2ce4	0x3000	f15d6678cc8e04d15dc1f40e7b55b39a	False	0.87158203125	data	7.429937630761524	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xae000	0xc	0x800	0dab594ddb09319917057eee0a3b7130	False	0.015625	data	0.02939680787012526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xaa100	0x26cd	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9980871841336958
RT_GROUP_ICON	0xac7e0	0x14	data	1.05
RT_VERSION	0xac804	0x2e0	data	0.4470108695652174
RT_MANIFEST	0xacaf4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 10:16:01.830677032 CEST	49674	443	192.168.2.6	173.222.162.64
May 4, 2024 10:16:01.830679893 CEST	49673	443	192.168.2.6	173.222.162.64
May 4, 2024 10:16:02.143174887 CEST	49672	443	192.168.2.6	173.222.162.64
May 4, 2024 10:16:07.637532949 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:08.079993010 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:08.080149889 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:08.525700092 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:08.536982059 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:08.978621006 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:08.978641987 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:08.978985071 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:09.420753002 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:09.471353054 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:10.851033926 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:11.294267893 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:11.294310093 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:11.294328928 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:11.294435024 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:11.346355915 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:11.356385946 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:11.440052032 CEST	49673	443	192.168.2.6	173.222.162.64
May 4, 2024 10:16:11.440053940 CEST	49674	443	192.168.2.6	173.222.162.64
May 4, 2024 10:16:11.752628088 CEST	49672	443	192.168.2.6	173.222.162.64
May 4, 2024 10:16:11.800679922 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:11.846467972 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:11.914387941 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:12.356578112 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:12.357618093 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:12.799458027 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:12.800743103 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:13.159192085 CEST	443	49698	173.222.162.64	192.168.2.6
May 4, 2024 10:16:13.159388065 CEST	49698	443	192.168.2.6	173.222.162.64
May 4, 2024 10:16:13.253591061 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:13.253931046 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:13.700778008 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:13.701153994 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:14.182547092 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:14.234062910 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:14.234370947 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:14.685085058 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:14.685539007 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:14.686222076 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:14.686269045 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:14.686285973 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:14.686306000 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:16:15.130297899 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:15.130351067 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:15.181576014 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:16:15.221333981 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:17:47.065613031 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:17:47.509490967 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:17:47.509659052 CEST	587	49699	103.132.98.224	192.168.2.6
May 4, 2024 10:17:47.509749889 CEST	49699	587	192.168.2.6	103.132.98.224
May 4, 2024 10:17:47.518764019 CEST	49699	587	192.168.2.6	103.132.98.224

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 10:16:07.047861099 CEST	55571	53	192.168.2.6	1.1.1.1
May 4, 2024 10:16:07.626666069 CEST	53	55571	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 4, 2024 10:16:07.047861099 CEST	192.168.2.6	1.1.1.1	0x5929	Standard query (0)	mail.pu.edu.af	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 4, 2024 10:16:07.626666069 CEST	1.1.1.1	192.168.2.6	0x5929	No error (0)	mail.pu.edu.af		103.132.98.224	A (IP address)	IN (0x0001)	false
May 4, 2024 10:16:23.357911110 CEST	1.1.1.1	192.168.2.6	0xcd67	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 4, 2024 10:16:23.357911110 CEST	1.1.1.1	192.168.2.6	0xcd67	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
May 4, 2024 10:16:37.708683968 CEST	1.1.1.1	192.168.2.6	0xbf19	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 4, 2024 10:16:37.708683968 CEST	1.1.1.1	192.168.2.6	0xbf19	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 4, 2024 10:16:08.525700092 CEST	587	49699	103.132.98.224	192.168.2.6	220 scloud.andc.gov.af ESMTP Postfix
May 4, 2024 10:16:08.536982059 CEST	49699	587	192.168.2.6	103.132.98.224	EHLO 960781
May 4, 2024 10:16:08.978641987 CEST	587	49699	103.132.98.224	192.168.2.6	250-scloud.andc.gov.af 250-PIPELINING 250-SIZE 204800000 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
May 4, 2024 10:16:08.978985071 CEST	49699	587	192.168.2.6	103.132.98.224	STARTTLS
May 4, 2024 10:16:09.420753002 CEST	587	49699	103.132.98.224	192.168.2.6	220 2.0.0 Ready to start TLS

Target ID:	0
Start time:	10:16:02
Start date:	04/05/2024
Path:	C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xoRN6fxApwT8Kin.exe"
Imagebase:	0x410000
File size:	698'368 bytes
MD5 hash:	5F051C2E92D5356803E765524197CF06
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2104726295.0000000005020000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2103132118.000000000444F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2103132118.000000000444F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.2103132118.0000000003B2D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2098586390.00000000027F1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000000.00000002.2098586390.0000000002A5E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:16:03
Start date:	04/05/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x4e0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3312406521.00000000028D9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3311154081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3311154081.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.3312406521.0000000002861000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	7.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	93
Total number of Limit Nodes:	10

Executed Functions

Function 00D04B20 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f4369a32f40ff7b89c1b4249d30d246c3009e0422d32b0c0abe60f03239ee7
Instruction ID: 9141e51e655779247adec9f13f544cd5befcfcaef3be36bdb66caf3be50e4040
Opcode Fuzzy Hash: b9f4369a32f40ff7b89c1b4249d30d246c3009e0422d32b0c0abe60f03239ee7
Instruction Fuzzy Hash: 07312823914B8A8BCB158D375C176DB7BB25B47228F04C349B9AC0F2E2D279DE56C709

Uniqueness

Uniqueness Score: -1.00%

Function 00D0D4D0 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D0D55E
GetCurrentThread.KERNEL32 ref: 00D0D59B
GetCurrentProcess.KERNEL32 ref: 00D0D5D8
GetCurrentThreadId.KERNEL32 ref: 00D0D631

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: f6d426a1443f142af9ec4d4f033db36c029b8d95b7ae2fd710830b5a86d9ed8d
Instruction ID: d7fbbdb561ac451ec1f43710134610e90c9732c83abe7cd4740b841c015784de
Opcode Fuzzy Hash: f6d426a1443f142af9ec4d4f033db36c029b8d95b7ae2fd710830b5a86d9ed8d
Instruction Fuzzy Hash: 5A5186B0D013498FDB04CFA9D948B9EBFF1EF88314F248459E409A73A0DB74A944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00D0D4E0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00D0D55E
GetCurrentThread.KERNEL32 ref: 00D0D59B
GetCurrentProcess.KERNEL32 ref: 00D0D5D8
GetCurrentThreadId.KERNEL32 ref: 00D0D631

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ef9fec509a32fcfe8318fa4df065d4ace494e5650c533d4551d535d08c91bb21
Instruction ID: 690ad4b7ba292924224b6f4c5ddb6d6692821657749f044da9e14d6c18fa4faf
Opcode Fuzzy Hash: ef9fec509a32fcfe8318fa4df065d4ace494e5650c533d4551d535d08c91bb21
Instruction Fuzzy Hash: 0F5156B0D0134A8FDB14CFAADA48B9EBBF1EF88314F248459E409A7390DB749944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00D0AE48 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D0B09E

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: b6e1c44d36281fb986243e5c5e87f218b972fb3d0d95f48151305f5195623cf2
Instruction ID: 49ebe41b638a9c717c15fdc73c903c7b20b27b213137c73b122ec3d14c87d78d
Opcode Fuzzy Hash: b6e1c44d36281fb986243e5c5e87f218b972fb3d0d95f48151305f5195623cf2
Instruction Fuzzy Hash: 667147B0A00B068FD724DF69D45575ABBF1FF88300F048A2DE44AD7A90DB75E945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D0592D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D059E9

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 44300331b57d432e4a5edfc3f102a0fb120efab3910d8ea1333cb40de2a0c131
Instruction ID: b09d24ea1cf860794a86c9c124e758f7f64d1404b65becb8a10758104a37f8ee
Opcode Fuzzy Hash: 44300331b57d432e4a5edfc3f102a0fb120efab3910d8ea1333cb40de2a0c131
Instruction Fuzzy Hash: 3441E2B0C0076DCFEB25CFA9C984B9EBBB1BF48304F24815AD409AB255DB756946CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D04508 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 00D059E9

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: d8de99fcbdead9f1f1935f310826fa8b369a4b2a0fa2bc241c29499bf86ca96c
Instruction ID: bf018c8b84dc681a4a591db52520c2562a1bc65acf35c4ecbf54dc134837aaa3
Opcode Fuzzy Hash: d8de99fcbdead9f1f1935f310826fa8b369a4b2a0fa2bc241c29499bf86ca96c
Instruction Fuzzy Hash: 59410470C0071DCFEB25CFA9C944B9EBBB5BF48304F20816AD409AB255DB756945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00D0D720 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D0D7AF

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 02e54d0483496d36beff78cb82808172c753e0fdef6f28834292d8016159b8e9
Instruction ID: 8a4c6ab0c432fc0a80b6a3306db4d21ca0a5c3789bedf4d25b1c51b302ad8f82
Opcode Fuzzy Hash: 02e54d0483496d36beff78cb82808172c753e0fdef6f28834292d8016159b8e9
Instruction Fuzzy Hash: FA2114B5800248DFDB10CFAAD585ADEBFF5FB48320F14801AE918A7350D378A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D0D728 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00D0D7AF

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 6a26832e367e24ac4a016e29eddafc74f40c3456921264f149331eb5e0ff0611
Instruction ID: 51b7fd100b1b61bfd72266757b7dbdb41486139ee9172796e321dd0218cd5aad
Opcode Fuzzy Hash: 6a26832e367e24ac4a016e29eddafc74f40c3456921264f149331eb5e0ff0611
Instruction Fuzzy Hash: 6D21E4B5900249DFDB10CF9AD984ADEBBF5FB48320F14801AE918A3350D378A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D0A228 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00D0B119,00000800,00000000,00000000), ref: 00D0B72A

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f3057e990738405647f5e98a8fae296b8f996fa831d9003b59d9ee999171b992
Instruction ID: 17c0544217a75b6e6ac4d51517985ec3a677f91adc19ee89c546d0dc7873d683
Opcode Fuzzy Hash: f3057e990738405647f5e98a8fae296b8f996fa831d9003b59d9ee999171b992
Instruction Fuzzy Hash: CF1117B6804309CFDB10CF9AD444BAEFBF4EB88320F14842AD519A7340C3B5A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D0B6BB Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,00D0B119,00000800,00000000,00000000), ref: 00D0B72A

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6f86c413fa9fcbaf443482141ff84328900125bb2e1aeea4a993cf98e913dbbe
Instruction ID: 2c87fba655f1eac022a7aa5b7a5dabff817909e1bd234d59c6669dd2c0a6058f
Opcode Fuzzy Hash: 6f86c413fa9fcbaf443482141ff84328900125bb2e1aeea4a993cf98e913dbbe
Instruction Fuzzy Hash: 9B1114B68043498FDB10CFAAD444BDEFBF4EB88320F14842AD559A7240C3B5A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D0B038 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 00D0B09E

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f47183570e40ff5d38c845e3c776f8513a5803e28921cfd5283780c4ae908323
Instruction ID: e541ffe97cccb38685d2ae9495e48bd54c13673bffb0a8241a85c71b32f5c67c
Opcode Fuzzy Hash: f47183570e40ff5d38c845e3c776f8513a5803e28921cfd5283780c4ae908323
Instruction Fuzzy Hash: FA1102B5C046498FDB10CF9AC444BDEFBF4EB88324F14841AD429A7240D3B9A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CAD1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095973970.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d44d25542e37e842392d33849895f2ee1580fc4b67715283df0778a2643c324
Instruction ID: 15c12ec2d87cb9a4b159e3ff9eca932a1accb601f6498e0abfb369b131842dfb
Opcode Fuzzy Hash: 9d44d25542e37e842392d33849895f2ee1580fc4b67715283df0778a2643c324
Instruction Fuzzy Hash: 6E2121B2504201EFCB05DF10D9C0B2ABB61FB89318F2082A9E90B0A656C336DC16CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CAD4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095973970.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e16c9db052bff974368c0986d606abd33488999f5d7531da0006e87f213ba53
Instruction ID: c63a55e02b5ccbea79b3685fabe86d7b6efe782df44dacf3a47c080743c4a3fb
Opcode Fuzzy Hash: 5e16c9db052bff974368c0986d606abd33488999f5d7531da0006e87f213ba53
Instruction Fuzzy Hash: 8F2145B2900241EFCB05DF14D9C0B2ABF61FB8831CF20C569E90B0B656C336D956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CBD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096055847.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cbd000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461deeef41b85bda9f6dc04021e11dccf2d8b5bddbdfd08933dff79b3cd91aad
Instruction ID: f852c8a3fc6950f7b8465608d0ea43efd7298d7e88519ece135438094dc80c58
Opcode Fuzzy Hash: 461deeef41b85bda9f6dc04021e11dccf2d8b5bddbdfd08933dff79b3cd91aad
Instruction Fuzzy Hash: FD212275604300EFCB14EF14E9C0B66BB61FB88314F20C5ADE90A0B292D37AD807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 00CBD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096055847.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cbd000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99841b1358146a3338200896ce4dec90fef1f8615e23f4dfbce41312f0ff797d
Instruction ID: bce781474fb934feee36310a633e62efa4dd91d40b367140c3c8da2b46b70d18
Opcode Fuzzy Hash: 99841b1358146a3338200896ce4dec90fef1f8615e23f4dfbce41312f0ff797d
Instruction Fuzzy Hash: 6A213475504280EFDB04DF14D9C0B66BBA5FB84314F20C5ADE90A4B292D376DC46CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CBD005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096055847.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cbd000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecc135126412e5822b4ec88607d88178b5668221ae446472888afa762263aac2
Instruction ID: f1f678db43261d2ce6cdc922a5961b6189dc9f6c1ea6cbd858ed4f23d2113b6a
Opcode Fuzzy Hash: ecc135126412e5822b4ec88607d88178b5668221ae446472888afa762263aac2
Instruction Fuzzy Hash: 07218E755093C08FCB02DF20D990755BF71EB46314F28C5EAD8498B2A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CAD1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095973970.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45d2786e60e1e4201bb004dcd9f59ae96814e242b2a6b2dda49e09682ea99c03
Instruction ID: 6469f9b3c301d2ef8a3158543d77a87ed52752c34dc66beac383f72e9c444ba2
Opcode Fuzzy Hash: 45d2786e60e1e4201bb004dcd9f59ae96814e242b2a6b2dda49e09682ea99c03
Instruction Fuzzy Hash: FB21E1B6404285CFCB06CF00D9C4B16BF72FB84314F24C2A9DC4A0B656C33AD926CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CAD4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095973970.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction ID: d3c2563f872bf31330fdfc83d39eab7077a4c66e99998f09f888701e639db4df
Opcode Fuzzy Hash: fed46cca7f742b7caa711e8ed735342f41d2c2d3303e466d284e334843d61363
Instruction Fuzzy Hash: CD11E6B6904284CFCB15CF10D5C4B1ABF71FB94318F24C6A9D84A0B656C33AD956CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00CBD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096055847.0000000000CBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cbd000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction ID: c628a263cffaccaa154e36c11ccaf8d327c1c118eeaafc4146c1e0b6008c03c3
Opcode Fuzzy Hash: 703b7abd3718bd21aa6f36dac6c8dc0e73c65716f16ca45b46755fc1987422b6
Instruction Fuzzy Hash: 9B11BB75504280DFCB01CF10C5C0B55BBA1FB84314F24C6A9D84A4B2A6C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CAD745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095973970.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 980c500b4a7bcece120d759ce0fde0f5dce5abe29a0f78c7e4f96767c0fe3cf1
Instruction ID: a62d5407e54864b0012bcdf1c3c2de2e17ccf760388dc4207e906ebf8d7fa0c6
Opcode Fuzzy Hash: 980c500b4a7bcece120d759ce0fde0f5dce5abe29a0f78c7e4f96767c0fe3cf1
Instruction Fuzzy Hash: 45012B71004345DAF7144E26CD84B66BF98DF42328F18C56AEE1B8A69AC6B99940C671

Uniqueness

Uniqueness Score: -1.00%

Function 00CAD744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2095973970.0000000000CAD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_cad000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0814282bc116a481b792153fd41b55c1bf28d76f13882db60c6b1e5d31e252ea
Instruction ID: 0a98cd12654415f9bbe0e864d215cff1d2487247a549301676e9f23545947635
Opcode Fuzzy Hash: 0814282bc116a481b792153fd41b55c1bf28d76f13882db60c6b1e5d31e252ea
Instruction Fuzzy Hash: 30F0F6714043449EF7148E15CCC8B62FF98EB81738F18C05AEE0A8B69AC3B99D44CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D0EFC4 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2096781701.0000000000D00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_d00000_xoRN6fxApwT8Kin.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802be132ee7be9a7343f05ecf8e1c95e414e89d24b53a5511f348e7b6906a849
Instruction ID: c4fee7663351451af1fc431fbdc445fee1534b0abd4a6516c4c59f39b140f937
Opcode Fuzzy Hash: 802be132ee7be9a7343f05ecf8e1c95e414e89d24b53a5511f348e7b6906a849
Instruction Fuzzy Hash: 5BA14E32E00205CFCF15DFA5C44069EB7B2FF85300B25857AE909AB2A6DB75ED56CB60

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exePID: 5988, Parent PID: 2812COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	9
Total number of Limit Nodes:	2

Executed Functions

Function 00D69BE8 Relevance: 2.8, Instructions: 2817COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f21351b3b81a3b89b3359c08d9f488bca8ca40b109b83644421619a072e3be14
Instruction ID: 8dab863aab76b0bdb74d6c7fe64403c83c559bfc4226a409fe9c29cf3cf7f75d
Opcode Fuzzy Hash: f21351b3b81a3b89b3359c08d9f488bca8ca40b109b83644421619a072e3be14
Instruction Fuzzy Hash: 4653F731D10B1A8ADB11EF68C8946A9F7B1FF99300F15D79AE45877121EB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00D6CE70 Relevance: 2.3, Instructions: 2322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec26410832899499c0898198ece1186569b28227587f72f7c87d7a60e485832
Instruction ID: d16a106405eef5c826aa3dc1ad6b22f4dee0e3b118ae1497a32958ccb9431aee
Opcode Fuzzy Hash: 7ec26410832899499c0898198ece1186569b28227587f72f7c87d7a60e485832
Instruction Fuzzy Hash: AD332D31D10B198ECB11EF68C8906ADF7B1FF99300F15D79AE458A7211EB70AAC5CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00D63E80 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VNm, xrefs: 00D640CB

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID: \VNm
API String ID: 0-2505523818
Opcode ID: 40837ca0122658b0f993e7ada5692cbb296a4dd0d25343b2660ed3efda05de80
Instruction ID: 5ec1840f390d5b5f5a8fa02fbbda7f701393bcf6447a539a14fc7e1b04b3530e
Opcode Fuzzy Hash: 40837ca0122658b0f993e7ada5692cbb296a4dd0d25343b2660ed3efda05de80
Instruction Fuzzy Hash: BA918C70E00319DFDF14CFA9C88179EBBF2AF98304F188129E415A7294EB749985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D69370 Relevance: .6, Instructions: 620COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2ad12a3375315e39f8412c42a46787c1b2498df8d5bcbd08f36bd3239cd9a3c
Instruction ID: b0eaeb17fc8c52d4ebf3ea637afeca87f1f767c1155805eedb73db228d8def63
Opcode Fuzzy Hash: b2ad12a3375315e39f8412c42a46787c1b2498df8d5bcbd08f36bd3239cd9a3c
Instruction Fuzzy Hash: 56328E34A102058FDB14DFA8D594BADBBB6FF88310F248569E909EB395DB70DC45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D64A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feec2f7933dde199a82795371d6ae3168df016e7b8d1b6204d3a47939caf263a
Instruction ID: 03186ed36f3736677b981e0f5ee3fc7c0cd9216fef96482342f6e572028105cb
Opcode Fuzzy Hash: feec2f7933dde199a82795371d6ae3168df016e7b8d1b6204d3a47939caf263a
Instruction Fuzzy Hash: F7B14D70E002198FDF14CFA9C8917AEBBF2AF88754F288129D815E7394EB749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00D64810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VNm, xrefs: 00D649D2
\VNm, xrefs: 00D6487F

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID: \VNm$\VNm
API String ID: 0-3240778399
Opcode ID: 71bcbb75dff0320ac4a002502c03829c999cc5a9898cdb582dc514b3cc83663d
Instruction ID: f5f098857cd7c8e77408d48e903c95427ea50f6e3781341380ab287efc419757
Opcode Fuzzy Hash: 71bcbb75dff0320ac4a002502c03829c999cc5a9898cdb582dc514b3cc83663d
Instruction Fuzzy Hash: 2B717B70E00249DFDF14DFA9C88179EBBF2BF88714F188129E415AB254EB749841CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D64807 Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VNm, xrefs: 00D649D2
\VNm, xrefs: 00D6487F

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID: \VNm$\VNm
API String ID: 0-3240778399
Opcode ID: 4e8ac3a5792e7f970213e4f2f3b1e07ec8b9182a8e31e350cba933ff9ad47247
Instruction ID: 8981a8ac065324d0248eaa747a2e4029a682c99ac9292ed4b7dcedfc67221b45
Opcode Fuzzy Hash: 4e8ac3a5792e7f970213e4f2f3b1e07ec8b9182a8e31e350cba933ff9ad47247
Instruction Fuzzy Hash: 727167B0E00249DFDF14DFA9C88179EBBF2BF88714F188129E415AB254EB749841CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05D1E1A8 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3315838232.0000000005D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5d10000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f7d9aa75b7b3d9afa562e068c81a86b4a032e627dcf5e32555898e82c543da
Instruction ID: 8b79afa1dc7f21a7d55c0943ccc4dcc07c311ff7042a3c46d82925e4f1727bfe
Opcode Fuzzy Hash: b9f7d9aa75b7b3d9afa562e068c81a86b4a032e627dcf5e32555898e82c543da
Instruction Fuzzy Hash: 6441F472E043559FDB04DFA9E8047EEBBF5EF89210F14866BD804A7291DB749841CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 05D1D57C Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05D1E1FA), ref: 05D1E2E7

Memory Dump Source

Source File: 00000002.00000002.3315838232.0000000005D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5d10000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: f43682abf72212aa313301e1df129fc5dd705113a772e061e2afcc1bd06c9e96
Instruction ID: 1865e17a249c7776ca9bec168df80d4645123371c32f25a8d52f8d2270c11658
Opcode Fuzzy Hash: f43682abf72212aa313301e1df129fc5dd705113a772e061e2afcc1bd06c9e96
Instruction Fuzzy Hash: B01103B1C0065A9BDB10CF9AD444B9EFBF4FF48320F14816AE918A7240D778A950CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05D1E278 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNELBASE(?,?,?,?,?,?,?,?,?,05D1E1FA), ref: 05D1E2E7

Memory Dump Source

Source File: 00000002.00000002.3315838232.0000000005D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5d10000_MSBuild.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 48809a3d0d68450da305b4ab3fe13ff0244e610190f9c8f0587b65ff7f9449c5
Instruction ID: 5f319e1017c3e03ec1d6c2e7f6ec05602a4e0953790bc9f52c78e79d4dd6cefd
Opcode Fuzzy Hash: 48809a3d0d68450da305b4ab3fe13ff0244e610190f9c8f0587b65ff7f9449c5
Instruction Fuzzy Hash: 4B1103B1C0065A9BDB10CF9AD544BDEFBB4FF48220F24816AE918A7240D778A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D63E74 Relevance: 1.5, Strings: 1, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\VNm, xrefs: 00D640CB

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID: \VNm
API String ID: 0-2505523818
Opcode ID: 5d3558b4cc517f8c25c00f756ebb273983da8b8ea67e78fd9c0a1c79d4103d1f
Instruction ID: 7d797ff96b191d2d8bf196b10b664d8c69e3f0d1e8a884327bc0e5a2ed047cf2
Opcode Fuzzy Hash: 5d3558b4cc517f8c25c00f756ebb273983da8b8ea67e78fd9c0a1c79d4103d1f
Instruction Fuzzy Hash: 49917C70E00319DFDF10CFA9C98579EBBF2BF98704F188129E415A7254EB749985CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D67903 Relevance: .6, Instructions: 556
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1679d805ffc80a5cb32aaee70b1e1974f38ae85182337617884087957f8a64fa
Instruction ID: ee58dd1a774cae8ac5720da4ef6aa8f3ccfbd112f563e0c10921b8bfe5f24ff6
Opcode Fuzzy Hash: 1679d805ffc80a5cb32aaee70b1e1974f38ae85182337617884087957f8a64fa
Instruction Fuzzy Hash: 53129530701606CBDB19AB7CE88422D37A6EBC6354B6859BDE005CB3A5CF75DD46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D64A8C Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d8dc2e47ab32b136786d2975f10c54971ca4a6634b2e1e11880fad90c9c9ee
Instruction ID: d2c2020cd33b7847cce780bb123a1e1b05227ef410da891b4d949ea04c163b5e
Opcode Fuzzy Hash: d5d8dc2e47ab32b136786d2975f10c54971ca4a6634b2e1e11880fad90c9c9ee
Instruction Fuzzy Hash: 02B14B70E00219CFDB10CFA9C89179EBBF1AF48754F288129D815EB394EB749885CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6935C Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f8195fc3a7d76f904487d80b61ade04a4d271ea079321f998676305199b5dc
Instruction ID: b72c25ab16f3f6f8301f3f1b0548b695030dc363f0b2111bb5081d932d68eeb1
Opcode Fuzzy Hash: 99f8195fc3a7d76f904487d80b61ade04a4d271ea079321f998676305199b5dc
Instruction Fuzzy Hash: E3A15034A10205CFDB15DFA4D594AADBBF6EF88310F288469E906EB395DB71DC42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D66ED0 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27c966c2f1978c11a078e7e0e735c4522e4b4bed915a849d5a89af361000d464
Instruction ID: beffb31eb0f649e9440aa7a503d0e857b19443eb14f9beec27d2d71925960b3f
Opcode Fuzzy Hash: 27c966c2f1978c11a078e7e0e735c4522e4b4bed915a849d5a89af361000d464
Instruction Fuzzy Hash: 4751B130A042499BDB15DF78D4147AEBBB6EF86314F2484AAE405EB391DB71DC458B70

Uniqueness

Uniqueness Score: -1.00%

Function 00D66CD4 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf77a7cd2bd7d6bc182d8628de704291189823ccf15c1471634e638178c97421
Instruction ID: c493fc3ac966f3e7903c3fd733d0a2f69a806e676da45f5e71b4be41d6bb65e6
Opcode Fuzzy Hash: bf77a7cd2bd7d6bc182d8628de704291189823ccf15c1471634e638178c97421
Instruction Fuzzy Hash: 0E511374E002588FDB14CFA9C884B9EBBB1FF48314F18812AE815AB351D775A844CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D66CE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966f38cd7059a59a22e5b68cbead093d91b2a2f019fea048b788b15b95506675
Instruction ID: 313f7b24ba89d00ab554ee8564d6fabbfa3609f7b4f77d48afef614129693695
Opcode Fuzzy Hash: 966f38cd7059a59a22e5b68cbead093d91b2a2f019fea048b788b15b95506675
Instruction Fuzzy Hash: 09510374E002188FDB14CFA9C884B9EBBB1FF48314F18812AE815BB351D775A844CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00D61128 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6cc44b190c931a51f8369bd213c97cc16e107854a45360e600958a8bfd40ea2
Instruction ID: 48de062c769a3fbcc51b22cebc537868b6d34be8ba69d7e9c369a9a314395639
Opcode Fuzzy Hash: d6cc44b190c931a51f8369bd213c97cc16e107854a45360e600958a8bfd40ea2
Instruction Fuzzy Hash: 7751BE71215A82DFC70AEF28FA949453FB1EBD2305704B9EDD1009B2BADFA46905CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00D61138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b98a867e9930c8fafc9ec3d5777231336c27ccbb16f416e162c9a8acf69ce9e
Instruction ID: 4bf996c2ec92bb28c9e23d742e3ac8538e680c7259aa9ed00d10e8527d282bb4
Opcode Fuzzy Hash: 9b98a867e9930c8fafc9ec3d5777231336c27ccbb16f416e162c9a8acf69ce9e
Instruction Fuzzy Hash: A8519871215A42DFC70AEF28FAA49553FA1FBD1305300B9EDD1009B2BADFA06906CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00D61488 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea93f50419bef37a96240725c8f952b20452e147188699c588a9473c52713a9f
Instruction ID: 813eb8b52eaf13ec6a3e6946817d1fd7b35f596fabd9510b6b32a9412f767563
Opcode Fuzzy Hash: ea93f50419bef37a96240725c8f952b20452e147188699c588a9473c52713a9f
Instruction Fuzzy Hash: 9731DE39A053519BCB21ABB898553AD7FB4EF46310F1C08BAE446D7392EB25DC81C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6F3AD Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c4e42bdd8937a2c89625a6a7b1bd31468957c5e4eaee06d96005a244fdc9a1
Instruction ID: 405322feae4b19940d447090d2670226df3e8b5dc04bf1a14b8651e056ddcbc4
Opcode Fuzzy Hash: 58c4e42bdd8937a2c89625a6a7b1bd31468957c5e4eaee06d96005a244fdc9a1
Instruction Fuzzy Hash: C9319C30B006458FDB1AAB34E55476E7BB6AB89344F2844B9C406DB396EE35DC46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D696D8 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f80b3c348ee6990f3fca56224185c37f5ce8d3296b34bf2ff4f2433431981a8
Instruction ID: 8d1f86cabdd26582e230ac2fc42340e0955349cb3e837278d954d18dad15a0ac
Opcode Fuzzy Hash: 8f80b3c348ee6990f3fca56224185c37f5ce8d3296b34bf2ff4f2433431981a8
Instruction Fuzzy Hash: 6C31A274F102068BDF20DEA9D99076EF379FB86310F24442AD51AE7384D634EC45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6F3C0 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e1488182b0f12a42b7360963441fabd23f70bff43f6a4e8cef25210e3db17b
Instruction ID: cd658f3fe14b51e5cfb2ae314a62d2a3161708674da26932f131a08709d36993
Opcode Fuzzy Hash: 42e1488182b0f12a42b7360963441fabd23f70bff43f6a4e8cef25210e3db17b
Instruction Fuzzy Hash: 7431AF307006058FDB19AB38E55466F7BA6AB89744F284478D406DB395EE31DC46C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D61383 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b8a472fd823c60ca42134eca5f9ca5ecb42719425babd775c6730be3adf16c2
Instruction ID: 776a30f01e91c34d2b7d50008ce53e505836f2cb3db7322b40caf8967fa289cd
Opcode Fuzzy Hash: 5b8a472fd823c60ca42134eca5f9ca5ecb42719425babd775c6730be3adf16c2
Instruction Fuzzy Hash: 7531C6346053428FDF16AB38E8987183B71EB83314F0829E9E506CB3B5DEA49C45CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6F270 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87de40076d4098c38ecd449d1d813b17a0f8e04a1ea5a1a960f11aad2a04987c
Instruction ID: f0be141151d6350c0a7f34de0a96a0e4d7ecbea1f8bde31b28df880fdc01b208
Opcode Fuzzy Hash: 87de40076d4098c38ecd449d1d813b17a0f8e04a1ea5a1a960f11aad2a04987c
Instruction Fuzzy Hash: D4315234E146459BCB19CFA8D85469EBBF2FF89310F248569E806E7390DB71EC45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00D66F70 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a68fa2d58cb5e11db124b6eb3957aef4edfebf0682b24ac5d50b3e7b5661b083
Instruction ID: 1c5e91172b962bcfff8bd5cc70cec176b8b2c2504c25ba5749b08d54a070ca37
Opcode Fuzzy Hash: a68fa2d58cb5e11db124b6eb3957aef4edfebf0682b24ac5d50b3e7b5661b083
Instruction Fuzzy Hash: B6314D30E102199BDB14CFA4D45479EB7B6EF85314F248569E806EB290EB71ED45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D626DC Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 512efacce4a27930312c1c201ff9b1f6bb9c64a6cfa3679f1e994b34511856ea
Instruction ID: 6bf2ee8b7c020a8a256e08a0c2e5d9bb88bdd431bc930d8d7520e752cb52cee4
Opcode Fuzzy Hash: 512efacce4a27930312c1c201ff9b1f6bb9c64a6cfa3679f1e994b34511856ea
Instruction Fuzzy Hash: 5041E0B090074DDFDB10CFA9C984ADEBBF5FF48714F248029E809AB254DB75A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00D617C0 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c038a4d41a427df074923c896e32b34ac1db95f00a215bde87e425b2dd82dc92
Instruction ID: 628f1749b0d32840e390a974df6fd8360602d54b8816098db56fba9c0d7a6fb2
Opcode Fuzzy Hash: c038a4d41a427df074923c896e32b34ac1db95f00a215bde87e425b2dd82dc92
Instruction Fuzzy Hash: 5B313839E002509FDB11EB78E81875E7BA6EB84310F1C49A9E906C3354EB74DC01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6F280 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1c8f32de9e8d95d44fe734ceffdcc202ce0f47327740a6aaf8a146840539139
Instruction ID: 6e8c67f7f22dfc91885d4134a5484435aaaf91b6da4e0f72e483dd965ab9929c
Opcode Fuzzy Hash: f1c8f32de9e8d95d44fe734ceffdcc202ce0f47327740a6aaf8a146840539139
Instruction Fuzzy Hash: 0D317034E146059BCB19CFA8D89469EB7F2FF89310F248529E806E7390DF70AC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00D626E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7271d1fa1e5d4a48d9c683bfa4422ef940ae4bc2bac45f8e960ce8f881cc93
Instruction ID: 5133383352ed91d0e55d35a653066cb2c51e8f3e3ed1bd3dad9570400f3757f2
Opcode Fuzzy Hash: bd7271d1fa1e5d4a48d9c683bfa4422ef940ae4bc2bac45f8e960ce8f881cc93
Instruction Fuzzy Hash: 5F41DCB0D0074DDFDB10DFA9C984A9EBBB5FF48710F248029E809AB254DB75A945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D69248 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8496965076a6886069a0509d3476418e0532159968a3725563dfca57eec219e7
Instruction ID: c91928d4888c76e8a4075d86b0c619f6d078849b60e4af54a90adde3f7e25aba
Opcode Fuzzy Hash: 8496965076a6886069a0509d3476418e0532159968a3725563dfca57eec219e7
Instruction Fuzzy Hash: 25317130E002499BDB05CFA4D46469EF7B6FF89300F54C56AE805AB384DB70DC46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D616A3 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 875ca7bd6a2bd2028508957066ecaa8fa6a2994b611a77919e461275dd9a57a4
Instruction ID: c4f3cf66c7260c081dbf1214fe567cd540b3a1d0f5923b84b806d7a555b7cdc8
Opcode Fuzzy Hash: 875ca7bd6a2bd2028508957066ecaa8fa6a2994b611a77919e461275dd9a57a4
Instruction Fuzzy Hash: 8E21C93C600141DFEB12EB38E8687593B62EB81304F1C6A9DD006CB276DBA4DC458BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D69258 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c5d5c40400dd3b3c9b862e98b030c7a760f7fdf6ada3a02ae2b084bfcf62c28
Instruction ID: aacedd372bc7a9177f9600c1881f9279fbbc53deb8e44d4a825d2a36d1300494
Opcode Fuzzy Hash: 7c5d5c40400dd3b3c9b862e98b030c7a760f7fdf6ada3a02ae2b084bfcf62c28
Instruction Fuzzy Hash: DA214430E1024A9BDB15CFA4D5A469EF7B6FF89300F54C669E805EB384DB719C46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D69148 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b2db950504e032ef459b2824ff116a706fc6b697b7c948542f70d8145a1cc28
Instruction ID: d227edb3a0bbaf642b6393468be19978d7447f310c2c1fd06b8916d76bead788
Opcode Fuzzy Hash: 5b2db950504e032ef459b2824ff116a706fc6b697b7c948542f70d8145a1cc28
Instruction Fuzzy Hash: 13216230E002169BDB14CF64C86469EF7B6AF89310F64852AE816FB340DB709C45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D64F88 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e49e89110edaf7b38c99826c39b0ebbd01da7150c1965cbd144f258c44614d
Instruction ID: d36fa1fac02907650d84550eacf0202b4db02d4e73329fe8e69f6f741e925750
Opcode Fuzzy Hash: 40e49e89110edaf7b38c99826c39b0ebbd01da7150c1965cbd144f258c44614d
Instruction Fuzzy Hash: B5212834A00605CFDB14DB78DA58AADBBF1AF89305F1404A8E406EB3A5DB369D41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D1D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3311917406.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d1d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f548b6dc00adb82c7f7671efe643590fa397fa1e78d33e35027fb63f81f3de0
Instruction ID: b26708feda8342dd1efebb99907d4239524de7d58f1dcc819abadc0156f99e91
Opcode Fuzzy Hash: 6f548b6dc00adb82c7f7671efe643590fa397fa1e78d33e35027fb63f81f3de0
Instruction Fuzzy Hash: 8E212575504204EFCB14DF14E9C0B66BB62FB88314F24C56DE9490B252CB76D886CA72

Uniqueness

Uniqueness Score: -1.00%

Function 00D69A20 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bfded0fad8b6c1e262ad5d630883044c5bf2e7825ff6e4ee92abf8266bccdce
Instruction ID: 31a32e3a90817765b1fd2cbc761148928424260d27b95cef1c9447a052dd9245
Opcode Fuzzy Hash: 7bfded0fad8b6c1e262ad5d630883044c5bf2e7825ff6e4ee92abf8266bccdce
Instruction Fuzzy Hash: A5216231B101158FEB14DBA9C964BAEBBFAFF88710F148065E505EB3A5DA71DD04C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00D1D005 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3311917406.0000000000D1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d1d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb7e41d889737e8e9251bf7c001f875dc5f34c9f6ed5c1394b9503a16646af68
Instruction ID: 60d55483009e2f91cad62d59c8ddad54bf304eabfca04ab447dc7ee380fb3306
Opcode Fuzzy Hash: fb7e41d889737e8e9251bf7c001f875dc5f34c9f6ed5c1394b9503a16646af68
Instruction Fuzzy Hash: F6215C7150D7C09FCB03CB24D990711BF71AB46214F29C5EBD8898F2A7C73A985ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D69158 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b8aff170a94e7b27badf05951144388f861fb84fc5d2f5a9a56323db2246947
Instruction ID: 089dcc70b805ab69cbeae062cfda987a099c28f9df9e05987c83333ba98910bc
Opcode Fuzzy Hash: 1b8aff170a94e7b27badf05951144388f861fb84fc5d2f5a9a56323db2246947
Instruction Fuzzy Hash: 14216230E0021A9BDB18CF64C86459EF7B6EF89310F64C52AE815FB380DB709C45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D61888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f0a9e31eb2e1db6a28086f23e5514a9f5e593782f7548a0263e953dbda4cfd
Instruction ID: 560fc9855813671de0d01249695ab1a1a3ec5bca52a61527637b19efac62317b
Opcode Fuzzy Hash: b1f0a9e31eb2e1db6a28086f23e5514a9f5e593782f7548a0263e953dbda4cfd
Instruction Fuzzy Hash: 19211934B00245DFDF14EB78C5657AE77B2AB89341F2804A9D106EB255DB368D41CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D6187B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204a0e4ce8320c2a64f4ae8d53d2f97ae8795b5ca272c5c74970789486bd58e6
Instruction ID: 5ced345b7fc014cb104a140af98502c2b79743ab2633ec60b1752fce7f708bbb
Opcode Fuzzy Hash: 204a0e4ce8320c2a64f4ae8d53d2f97ae8795b5ca272c5c74970789486bd58e6
Instruction Fuzzy Hash: BF215A346002459FDB24EB78C5647AE7BB1AF89341F2804A9D506EB295DB368C41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D616B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d1e22a88e4f436dea75a6874421b6219a1a19b10cc1769ce28f7e733435eb6
Instruction ID: 736010730a21c8472de016069374bae78a9910f09a9cd1443ec3dfd25d35a420
Opcode Fuzzy Hash: f1d1e22a88e4f436dea75a6874421b6219a1a19b10cc1769ce28f7e733435eb6
Instruction Fuzzy Hash: C621B43C600642DBEF15EB28EC987193726E781314F186AA9E506CB375DFB8DC458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D64F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b035391c63e7eaf6f4cdc37d772eefee1d6b9782cd3dd5dfca9a758b1a58a0
Instruction ID: 334bc1615d7cc748d1cccc664b7c7d41fafe8bc04844140ef67d5ef7439b1fb8
Opcode Fuzzy Hash: 52b035391c63e7eaf6f4cdc37d772eefee1d6b9782cd3dd5dfca9a758b1a58a0
Instruction Fuzzy Hash: FD21FA34700605CFDB14EB78D958AAD7BF1AF89305F1004A8E506EB3A5DB36DD41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D60848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9356311dd39a74ca98336f12163593d73d85da92f5ad6f962376618e71a3e69
Instruction ID: 359c7fef52ff44e9876c7fafe2b18ede26956609a0fbc42acaaca559652a5185
Opcode Fuzzy Hash: d9356311dd39a74ca98336f12163593d73d85da92f5ad6f962376618e71a3e69
Instruction Fuzzy Hash: 44118F30B002098BEF15AB79D81472B3B65EB85314F28857AD246CF395DA61CC818BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00D60838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9132466d162afae104e6b3f225ffd6dcaafcf13fbf06ae9dd8a678415022e3
Instruction ID: c6882921db1f918d3ec15929e35d74cf8886c37cd9413ea96096338e492ca897
Opcode Fuzzy Hash: 3b9132466d162afae104e6b3f225ffd6dcaafcf13fbf06ae9dd8a678415022e3
Instruction Fuzzy Hash: 1911E730A013098BEF16BB75981472B3F65EB42310F28857AD546CF2C2DA61CC448BF1

Uniqueness

Uniqueness Score: -1.00%

Function 00D66B87 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90671566fe5d304eeea8384ea3629333a820ef7728fde689f8657507a8f2fd0f
Instruction ID: a47e383feb878d874567c580ae09e3629026d14288d1a1944e7d50ce4b3b70a9
Opcode Fuzzy Hash: 90671566fe5d304eeea8384ea3629333a820ef7728fde689f8657507a8f2fd0f
Instruction Fuzzy Hash: 1011CE317002059FC315AB78C4147AE7BE6FF8A711F1448AAD149CB782EF768C8287E1

Uniqueness

Uniqueness Score: -1.00%

Function 00D61498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22fe7eee87aeb2267b56d442f28995f171e950c3e517fbe7abf07d6d944da833
Instruction ID: 73bd2a54fa4921812b8a4ab25965e7e113ef61f5d678ab9d15f30d7099903dea
Opcode Fuzzy Hash: 22fe7eee87aeb2267b56d442f28995f171e950c3e517fbe7abf07d6d944da833
Instruction Fuzzy Hash: 7E010035A012259FCB25EFB984511AEBBF5EF88311B29047AD806E7301EB35D941CBF5

Uniqueness

Uniqueness Score: -1.00%

Function 00D69888 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ea8432965785d7ef72813c4ae888a2e1902a9cb91833a96db64ad9202e7a85
Instruction ID: 92f6a261f4f0e7915472500c947cf32c5fa6d3cfc3c3b2a1a730bc05d134245a
Opcode Fuzzy Hash: 56ea8432965785d7ef72813c4ae888a2e1902a9cb91833a96db64ad9202e7a85
Instruction Fuzzy Hash: D301B530A002048BDB14DF55D94578EBB75FF84310F648168D90C6F29AEBB09E05CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D680E8 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f36ff4b1ffc9dcc9ff9379d2f9d292d432d0e8b66187c554f1bd409973ebedcb
Instruction ID: 79b2071e3695abdc307e4cd75e1dc5b7217a5b6c0a1d255ae5836e2e6048c78b
Opcode Fuzzy Hash: f36ff4b1ffc9dcc9ff9379d2f9d292d432d0e8b66187c554f1bd409973ebedcb
Instruction Fuzzy Hash: A3018F3090128ADFDB06FBB8F99169D7FB1EF81300F1062ADC505AB2A5DF741A049B51

Uniqueness

Uniqueness Score: -1.00%

Function 00D67088 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d3fd0d0213ec9c6a61d3d3d28cb3666a15c312b6980670d5e2d536a7ff32d1
Instruction ID: b49566ceed3d7a1e9b4aee9fdb30b846ac18e0199f2a7ee21915330a9e3e30e5
Opcode Fuzzy Hash: b9d3fd0d0213ec9c6a61d3d3d28cb3666a15c312b6980670d5e2d536a7ff32d1
Instruction Fuzzy Hash: 0AF0C435B016088FC714EB74D998B6D77B2EF89215F5044A8E506DB3A4DB35AD42CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00D680F8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3312082227.0000000000D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d60000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f15d3c87fbfb98d5909ac7e1d44be83dd1ef5edcdab72aeda4169869114335
Instruction ID: fec747a58033cce0c27016c5302bdac800264269baab53c36b4a16ca76912da6
Opcode Fuzzy Hash: a4f15d3c87fbfb98d5909ac7e1d44be83dd1ef5edcdab72aeda4169869114335
Instruction Fuzzy Hash: 8DF0623090114ADFDB45FFB8F99169D7BB5EB80300F5066ADC104AB2A5EFB12F049BA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xoRN6fxApwT8Kin.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Networking

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xoRN6fxApwT8Kin.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
xoRN6fxApwT8Kin.exe

Function 00D0D4D0 Relevance: 6.1, APIs: 4, Instructions: 134
threadCOMMON

Function 00D0D4E0 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 00D0AE48 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Function 00D0592D Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Function 00D04508 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 00D0D720 Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Function 00D0D728 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Function 00D0A228 Relevance: 1.6, APIs: 1, Instructions: 55
libraryCOMMON

Function 00D0B6BB Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 00D0B038 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Function 00D63E80 Relevance: 1.5, Strings: 1, Instructions: 238
COMMON

Function 00D64810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Function 00D64807 Relevance: 2.7, Strings: 2, Instructions: 179
COMMON

Function 05D1E1A8 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Function 05D1D57C Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre