Edit tour

Windows Analysis Report
PO234400.exe

Overview

General Information

Sample name:	PO234400.exe
Analysis ID:	1410984
MD5:	1ed78424905206c4549ac51b97b5120b
SHA1:	bd106b43a6cad1fc21d8b71cb70c86295a9439b7
SHA256:	5ca87353c4d37e66f76875a46235208796dd620ad3cb7cebc6b5e66be55b2913
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Outbound SMTP Connections

Tries to load missing DLLs

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

PO234400.exe (PID: 7276 cmdline: C:\Users\user\Desktop\PO234400.exe MD5: 1ED78424905206C4549AC51B97B5120B)

powershell.exe (PID: 7460 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7724 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

PO234400.exe (PID: 7484 cmdline: C:\Users\user\Desktop\PO234400.exe MD5: 1ED78424905206C4549AC51B97B5120B)

PO234400.exe (PID: 7516 cmdline: C:\Users\user\Desktop\PO234400.exe MD5: 1ED78424905206C4549AC51B97B5120B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": "     *o9H+18Q4%;M     "}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.2607967300.000000000322A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.2606062779.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000006.00000002.2607967300.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.2607967300.00000000031D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1379891077.00000000040EE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: PO234400.exe PID: 7276	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO234400.exe PID: 7516	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO234400.exe PID: 7516	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.PO234400.exe.418b348.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PO234400.exe.4162328.5.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
6.2.PO234400.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PO234400.exe.418b348.6.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.PO234400.exe.4162328.5.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\PO234400.exe, ParentImage: C:\Users\user\Desktop\PO234400.exe, ParentProcessId: 7276, ParentProcessName: PO234400.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe, ProcessId: 7460, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 199.79.62.115, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\Desktop\PO234400.exe, Initiated: true, ProcessId: 7516, Protocol: tcp, SourceIp: 192.168.2.8, SourceIsIpv6: false, SourcePort: 49708

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: C:\Users\user\Desktop\PO234400.exe, ParentImage: C:\Users\user\Desktop\PO234400.exe, ParentProcessId: 7276, ParentProcessName: PO234400.exe, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe, ProcessId: 7460, ProcessName: powershell.exe

Snort Signatures

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	03/18/24-14:30:28.601602
SID:	2840032
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla CnC Exfil Activity - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	03/18/24-14:30:28.601602
SID:	2855542
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Exfil via SMTP - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	03/18/24-14:30:28.601602
SID:	2855245
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Agent Tesla Telegram Exfil - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	03/18/24-14:30:28.601602
SID:	2851779
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	03/18/24-14:30:28.601602
SID:	2030171
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.8 - Destination IP: 199.79.62.115

Timestamp:	03/18/24-14:30:28.601602
SID:	2839723
Source Port:	49708
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://mail.mbarieservicesltd.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: powershell.exe.7460.3.memstrmin

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.mbarieservicesltd.com", "Username": "saless@mbarieservicesltd.com", "Password": " *o9H+18Q4%;M "}

Multi AV Scanner detection for submitted file

Source: PO234400.exe

ReversingLabs: Detection: 60%

Machine Learning detection for sample

Source: PO234400.exe

Joe Sandbox ML: detected

Source: PO234400.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO234400.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: YgrO.pdb source: PO234400.exe
Source:	Binary string: YgrO.pdbSHA256_ source: PO234400.exe

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2855542 ETPRO TROJAN Agent Tesla CnC Exfil Activity 192.168.2.8:49708 -> 199.79.62.115:587
Source: Traffic	Snort IDS: 2855245 ETPRO TROJAN Agent Tesla Exfil via SMTP 192.168.2.8:49708 -> 199.79.62.115:587
Source: Traffic	Snort IDS: 2851779 ETPRO TROJAN Agent Tesla Telegram Exfil 192.168.2.8:49708 -> 199.79.62.115:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.8:49708 -> 199.79.62.115:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.8:49708 -> 199.79.62.115:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.8:49708 -> 199.79.62.115:587

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 199.79.62.115:587

Source: Joe Sandbox View

IP Address: 199.79.62.115 199.79.62.115

Source: Joe Sandbox View

ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: global traffic

TCP traffic: 192.168.2.8:49708 -> 199.79.62.115:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: mail.mbarieservicesltd.com

Source: PO234400.exe, 00000006.00000002.2607967300.000000000322A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.mbarieservicesltd.com
Source: PO234400.exe, 00000006.00000002.2607967300.000000000322A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mbarieservicesltd.com
Source: PO234400.exe, 00000000.00000002.1378595010.0000000002F57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO234400.exe	String found in binary or memory: http://tempuri.org/DataSet1.xsd

Source: C:\Users\user\Desktop\PO234400.exe	Code function: 0_2_012CD364	0_2_012CD364
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 0_2_07B1BAF0	0_2_07B1BAF0
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 0_2_07B15688	0_2_07B15688
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 0_2_07B15653	0_2_07B15653
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 0_2_07B171E8	0_2_07B171E8
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 0_2_07B15EF8	0_2_07B15EF8
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 0_2_07B15AC0	0_2_07B15AC0
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 0_2_07B18A30	0_2_07B18A30
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 0_2_07B12951	0_2_07B12951
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_01604140	6_2_01604140
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_01604D58	6_2_01604D58
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_0160F7B0	6_2_0160F7B0
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_01604488	6_2_01604488
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_0691E790	6_2_0691E790
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_069145F0	6_2_069145F0
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_06917D00	6_2_06917D00
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_0691CC10	6_2_0691CC10
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_06919DC0	6_2_06919DC0
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_0691432C	6_2_0691432C

Source: PO234400.exe, 00000000.00000000.1360411575.0000000000AFE000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameYgrO.exe: vs PO234400.exe
Source: PO234400.exe, 00000000.00000002.1387729571.00000000075C0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO234400.exe
Source: PO234400.exe, 00000000.00000002.1378595010.0000000002F71000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs PO234400.exe
Source: PO234400.exe, 00000000.00000002.1376728133.000000000102E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs PO234400.exe
Source: PO234400.exe, 00000000.00000002.1387278956.0000000007262000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePowerShell.EXEj% vs PO234400.exe
Source: PO234400.exe, 00000000.00000002.1379891077.00000000040EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs PO234400.exe
Source: PO234400.exe, 00000000.00000002.1379891077.00000000040EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameTyrone.dll8 vs PO234400.exe
Source: PO234400.exe, 00000006.00000002.2606062779.000000000042C000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7b99aba2-3c62-4861-97de-170caa2c3039.exe4 vs PO234400.exe
Source: PO234400.exe, 00000006.00000002.2606321660.00000000012F9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs PO234400.exe
Source: PO234400.exe	Binary or memory string: OriginalFilenameYgrO.exe: vs PO234400.exe

Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior

Source: PO234400.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PO234400.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.PO234400.exe.418b348.6.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO234400.exe.418b348.6.raw.unpack, O.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.PO234400.exe.418b348.6.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO234400.exe.418b348.6.raw.unpack, P.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO234400.exe.418b348.6.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO234400.exe.418b348.6.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO234400.exe.418b348.6.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.PO234400.exe.418b348.6.raw.unpack, N.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, dG0cRqRa8r2T3nra0D.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, IZKjU01Eq84VxH2YtA.cs	Security API names: _0020.SetAccessControl
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, IZKjU01Eq84VxH2YtA.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, IZKjU01Eq84VxH2YtA.cs	Security API names: _0020.AddAccessRule

Source: 0.2.PO234400.exe.2f4f174.3.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.PO234400.exe.6000000.8.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject
Source: 0.2.PO234400.exe.2f7ff00.2.raw.unpack, ReactionVessel.cs	Suspicious method names: .ReactionVessel.Inject

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/6@1/1

Source: C:\Users\user\Desktop\PO234400.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO234400.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7508:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a05r2hnr.pls.ps1

Jump to behavior

Source: PO234400.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: PO234400.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\PO234400.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO234400.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO234400.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PO234400.exe

ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\PO234400.exe C:\Users\user\Desktop\PO234400.exe
Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe
Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Users\user\Desktop\PO234400.exe C:\Users\user\Desktop\PO234400.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Users\user\Desktop\PO234400.exe C:\Users\user\Desktop\PO234400.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Users\user\Desktop\PO234400.exe C:\Users\user\Desktop\PO234400.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Users\user\Desktop\PO234400.exe C:\Users\user\Desktop\PO234400.exe	Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\PO234400.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: PO234400.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: PO234400.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: PO234400.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: YgrO.pdb source: PO234400.exe
Source:	Binary string: YgrO.pdbSHA256_ source: PO234400.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: PO234400.exe, Form9.cs	.Net Code: InitializeComponent contains xor as well as GetObject
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, IZKjU01Eq84VxH2YtA.cs	.Net Code: lgJAWSGwI5 System.Reflection.Assembly.Load(byte[])

Source: PO234400.exe

Static PE information: 0xF37F2E8A [Mon Jun 15 09:21:14 2099 UTC]

Source: C:\Users\user\Desktop\PO234400.exe	Code function: 0_2_012C01A9 push esp; ret		0_2_012C01B3
Source: C:\Users\user\Desktop\PO234400.exe	Code function: 6_2_069104B0 push es; ret		6_2_069104C0

Source: PO234400.exe

Static PE information: section name: .text entropy: 7.8603183590444825

Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, aHaM0V3Y6ypixdFZQS.cs	High entropy of concatenated method names: 'gCsF7k4lAU', 'aiNFVBSXXg', 'CcEF0qZveA', 'mCwFC4fbmN', 'CG0FI05jaS', 'dTGFJyM4TB', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, IZKjU01Eq84VxH2YtA.cs	High entropy of concatenated method names: 'AntjrPoMlO', 'z7Ij8ZfGt2', 'Wkqj4H6rGH', 'VYbjfrS5RR', 'A1AjcENMBU', 'kBrjbIXyyg', 'JCxj3OW3h6', 'kDojadXbPc', 'zBljQaNNhl', 'XEdjo3nOP5'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, dG0cRqRa8r2T3nra0D.cs	High entropy of concatenated method names: 'UmS4IFLhGb', 'FvM4E0fPKU', 'shc4PvBehN', 'RCw4ZfhXgR', 'IUc4dSekII', 'ho54yTApZN', 'BQC4xKtIOA', 'mVr46et30n', 'IXS4tm90qe', 's264mVbeKn'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, gP5fS0ThqVLnq2uc8A.cs	High entropy of concatenated method names: 'dwx3ibeovC', 'u4w3R26YEJ', 'UKU3WGWpsB', 'Wnp3sZYGqJ', 'A7S3HhF5fe', 'h3p31ikBx1', 'yuY3U7w898', 'JYS3we4VFa', 'wPy35yvTHZ', 'gGp3O5X8U2'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, CpolQWAjBSp0XoohU7.cs	High entropy of concatenated method names: 'DqXX3kmqEq', 'rebXaPijdT', 'yHmXokomhB', 'kOZXnrWYKL', 'yTVXKAi18S', 'FWyXhwm2Wr', 'I6mkMqjjAV6gWbq1wI', 'rPK9EN66g4ZuQ7hQXj', 'pg0XXQL0pE', 'fYEXjnWGGm'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, hEhQkB2ZdTclJYwpZV.cs	High entropy of concatenated method names: 'Avse6hVs4q', 'A5lemXxhfn', 'qBeF2xahec', 'cwuFXSMHYw', 'ClSeT7oaqN', 'Rd7eqjxPON', 'lWeeBi0u3x', 'pVgeI8aHby', 'LcXeEqel3O', 'ExoePWYygO'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, TOioCChx7ZwAfc8sJP.cs	High entropy of concatenated method names: 'kgR383S6mA', 'EBT3faPsrK', 'pgS3bveFW8', 'nWSbmptxEB', 'MaYbzHqc08', 'uNC32YV95g', 'UPi3XwIPKK', 'P523MuI8tZ', 'QwY3jp9XwV', 'dXH3AjrpSE'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, tK0XW14eOIiwDBeNYRA.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'XyUuIScM5J', 'yjDuEAZ9iI', 'y9uuPfxgFi', 'JiVuZVo4yJ', 'jhFudvv8kC', 'KDAuystY6o', 'aQouxrcs0a'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, V6gdXUqy5MOlrIu7PW.cs	High entropy of concatenated method names: 'ztkKDfMmen', 'MXYKqce8TY', 'sMjKIXZ5V3', 'iIRKEDJGmc', 'GDnKVby7WW', 'N6JK0thbNu', 'pTbKCHQHAl', 'pD0KJW51Ot', 'AOeKvlqaUt', 'zoSKpeiOa4'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, ITTa6Q4XFHgRdBeiMdF.cs	High entropy of concatenated method names: 'RgiNiDAqOr', 'fcsNRDjiV8', 'I6kNWdosCd', 'EDkNs2nnxh', 'iUsNHFZ8gq', 'VD3N1U5SlM', 'NJTNUO4C9d', 'nAINwok1Eo', 'qSUN5QPIwQ', 'KpENOvQ4AQ'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, aLVhkw7UQ3f0kK8ZEu.cs	High entropy of concatenated method names: 'oGvbr0M9WA', 'Ahsb4pQKuT', 'cGkbcRDs6M', 'I8Xb39jHWb', 'nQ1ba6OBEo', 'Xm7cd3HG0T', 'Whtcy2GuRJ', 'wYccxeT1Hm', 'RmRc6jtjrH', 'D8ZctVJtJS'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, HMbQwtzm8ENdW7OadK.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ADJNGPnBgV', 'KekNKScF4h', 'zG8NhYpC5F', 'wMfNeCZyZk', 'COPNFmCfNb', 'sBmNNAalZ0', 'fQRNuFiKu7'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, glyVrDHeWXfPMbiDx4.cs	High entropy of concatenated method names: 'lArF8mOR0T', 'UXtF4oX2BM', 'CQiFfASJZK', 'G3RFcvRC8y', 'rvmFbm6FeQ', 'dCmF3JdR9o', 'dS5FaE6wTg', 'AwrFQT003h', 'hMCFoCyyUL', 'd2sFn3KhuS'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, q3MIdHPT60Wa9gvcfC.cs	High entropy of concatenated method names: 'Bq8Gw5CTwh', 'jGuG5sRG2l', 'WJkG7W4KWG', 'HgIGVZ0fBB', 'ILSGC5QjjA', 'lbjGJ5rFma', 'vtwGpZRT0n', 'PoFGYvaS8o', 'xu3GD8Zxw4', 'g1xGTnQ4Ql'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, htDdwZkse3kWN2CecU.cs	High entropy of concatenated method names: 'zycfsm5sb2', 'MGGf1AEIAC', 'IgtfwGtfDs', 'aPGf5tQ11v', 'BEffKPN1RJ', 'c3Tfh62cQs', 'LIKfe3DP5i', 'H8ufF2UtOn', 'u9rfNlVmOl', 'XUmfuieYuI'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, barJkfKldSjloEQ6gN.cs	High entropy of concatenated method names: 'kCHWkK2CV', 'lAws2nw5n', 'Pkx1teJZf', 'vdiUxrnuu', 'hHM5DU0t8', 's9GOxm7vJ', 'jbrmhhZIqN5FRlHJdC', 'DUTVAHmraj5WPQst0a', 'mc0FDRufd', 'VTouX5TxQ'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, bgO281GQpjSekMRPQK.cs	High entropy of concatenated method names: 'ToString', 'evyhTpVjNK', 'kaQhV2oXK3', 'nsyh0WEasY', 'lGxhCXkZ41', 'miJhJgTDZJ', 'cBmhviR2aU', 'uHjhpRTOWU', 'KcphYlylqh', 'UtOhl6XeXT'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, Wd4UcV5MG836f5amMB.cs	High entropy of concatenated method names: 'PW3eoL7iBU', 'COyenPvYck', 'ToString', 'JUTe8ipaWI', 'EQie4IC7D0', 'WkqefMhYjZ', 'qDxecy93Um', 'VCPebyNHv4', 'cbQe3WF0Yi', 'YYTeaAL0jD'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, YmC0jQOf8YTrbWO2VG.cs	High entropy of concatenated method names: 'BUyNX5So1X', 'z2MNjQjttV', 'cMENA8cpR9', 'w7MN8pJOR3', 'FR6N4FcQuQ', 'JKNNcglXpA', 'hnBNbQf6VD', 'qB8FxG7ci3', 'x0yF6Pd5cD', 'tLFFta15pj'
Source: 0.2.PO234400.exe.75c0000.9.raw.unpack, vQcKgrYfOr76aSFkqA.cs	High entropy of concatenated method names: 'Dispose', 'ysIXtxmDfR', 'rgMMV4qDyj', 'qOrkkAOvBW', 'WJDXm1ItqH', 'FLPXzDCKkP', 'ProcessDialogKey', 'cs2M25wsnB', 'KxIMX2Kknl', 'FPlMMsVyDH'

Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: PO234400.exe PID: 7276, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\PO234400.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\PO234400.exe	Memory allocated: 1260000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Memory allocated: 2F10000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Memory allocated: 14F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Memory allocated: 7B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Memory allocated: 8B20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Memory allocated: 8DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Memory allocated: 9DC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Memory allocated: 1600000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Memory allocated: 31D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Memory allocated: 51D0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4917	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1674	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Window / User API: threadDelayed 1362	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Window / User API: threadDelayed 3363	Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe TID: 7304	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7656	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7692	Thread sleep count: 1362 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7692	Thread sleep count: 3363 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -11990383647911201s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -99873s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -99765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -99656s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -99543s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -99436s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -99327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -99216s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -99109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -98999s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -98888s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -98781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -98671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -98561s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -98453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -98343s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -98234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -98124s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -98015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -97906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -97796s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe TID: 7708	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\PO234400.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\PO234400.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 99873	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 99543	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 99436	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 99327	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 99216	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 98999	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 98888	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 98671	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 98561	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 98453	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 98343	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 98234	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 98124	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 98015	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 97906	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 97796	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: PO234400.exe, 00000006.00000002.2606405491.00000000014EF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\user-

Source: C:\Users\user\Desktop\PO234400.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe
Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\PO234400.exe

Memory written: C:\Users\user\Desktop\PO234400.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Users\user\Desktop\PO234400.exe C:\Users\user\Desktop\PO234400.exe	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Process created: C:\Users\user\Desktop\PO234400.exe C:\Users\user\Desktop\PO234400.exe	Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Users\user\Desktop\PO234400.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Users\user\Desktop\PO234400.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PO234400.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PO234400.exe.418b348.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO234400.exe.4162328.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PO234400.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO234400.exe.418b348.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO234400.exe.4162328.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2606062779.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1379891077.00000000040EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000006.00000002.2607967300.000000000322A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2607967300.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO234400.exe PID: 7516, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\PO234400.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\PO234400.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\PO234400.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\PO234400.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000006.00000002.2607967300.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO234400.exe PID: 7516, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.PO234400.exe.418b348.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO234400.exe.4162328.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.PO234400.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO234400.exe.418b348.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.PO234400.exe.4162328.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2606062779.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1379891077.00000000040EE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000006.00000002.2607967300.000000000322A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2607967300.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO234400.exe PID: 7516, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	111 Process Injection	1 Masquerading	1 OS Credential Dumping	111 Security Software Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	1 Credentials in Registry	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Timestomp	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PO234400.exe	61%	ReversingLabs	Win32.Spyware.Negasteal
PO234400.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://mbarieservicesltd.com	0%	Avira URL Cloud	safe
http://mail.mbarieservicesltd.com	100%	Avira URL Cloud	malware
http://tempuri.org/DataSet1.xsd	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mbarieservicesltd.com	199.79.62.115	true	true		unknown
mail.mbarieservicesltd.com	unknown	unknown	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://mbarieservicesltd.com	PO234400.exe, 00000006.00000002.2607967300.000000000322A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO234400.exe, 00000000.00000002.1378595010.0000000002F57000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/DataSet1.xsd	PO234400.exe	false	Avira URL Cloud: safe	unknown
http://mail.mbarieservicesltd.com	PO234400.exe, 00000006.00000002.2607967300.000000000322A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
199.79.62.115	mbarieservicesltd.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1410984
Start date and time:	2024-03-18 14:29:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PO234400.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/6@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 46 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: PO234400.exe

Simulations

Behavior and APIs

Time	Type	Description
14:30:23	API Interceptor	22x Sleep call for process: PO234400.exe modified
14:30:25	API Interceptor	12x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
199.79.62.115	260224-027.exe	Get hash	malicious	AgentTesla	Browse
	xWDXthOyvb.exe	Get hash	malicious	AgentTesla	Browse
	mo49c5w1Dg.exe	Get hash	malicious	AgentTesla	Browse
	SA3190 - SO3216.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	PO-8700.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse
	60025450.exe	Get hash	malicious	AgentTesla	Browse
	quote_200006595.exe	Get hash	malicious	AgentTesla	Browse
	Quotation_Details.exe	Get hash	malicious	AgentTesla	Browse
	SWIFT004.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.8086.15681.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mbarieservicesltd.com	Quote_3309.exe	Get hash	malicious	AgentTesla	Browse	35.186.223.180

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PUBLIC-DOMAIN-REGISTRYUS	WZEF7aEu11.exe	Get hash	malicious	Unknown	Browse	74.119.239.234
	WZEF7aEu11.exe	Get hash	malicious	Unknown	Browse	74.119.239.234
	WZEF7aEu11.exe	Get hash	malicious	Unknown	Browse	74.119.239.234
	260224-027.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	WZEF7aEu11.exe	Get hash	malicious	Unknown	Browse	74.119.239.234
	https://sprl.in/wBwUGK0	Get hash	malicious	Unknown	Browse	216.10.243.64
	Proforma Invoice001&002-pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	PO m#U1edbi_#28809466.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	PO.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143
	DHL Receipt_ AWB#62600719881.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224

Process:	C:\Users\user\Desktop\PO234400.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.380046556058007
Encrypted:	false
SSDEEP:	48:tWSU4xympgv4RIoUP7gZ9tK8NPZHUx7u1iMuge//ZSUyus:tLHxv2IfLZ2KRH6OugEs
MD5:	6CC7DDDD06B381EA5284A27AE5E5B633
SHA1:	D41CE03873A1DCE6220D830CD8212B93B4265DBF
SHA-256:	A5A75507E7FEC921191D067D0092446489C317DDC070A8C4B78EB26563DA8927
SHA-512:	91A4496B77D67240A41548997C2858DCB14ED29579586738157568220A902F1E7FB47FC09FE1DC27B1B0315DDBE6E039D6C67217AE472E05621E97ADC46F1A18
Malicious:	false
Reputation:	low
Preview:	@...e.................................,..............@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServicesL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5m1c2nii.nam.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a05r2hnr.pls.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fp35rzaj.cbr.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Reputation:	high, very likely benign file
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hdyvhbvf.dsv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.848927129971296
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	PO234400.exe
File size:	634'368 bytes
MD5:	1ed78424905206c4549ac51b97b5120b
SHA1:	bd106b43a6cad1fc21d8b71cb70c86295a9439b7
SHA256:	5ca87353c4d37e66f76875a46235208796dd620ad3cb7cebc6b5e66be55b2913
SHA512:	dbe0ed36c6813e0037d578e6a79562949386e135c755b9da95e23686e71a4c5f22f5fa096d851b67393d0a9351c72c4124b0be2d5d610704f483021acd772380
SSDEEP:	12288:S2ShC3RLZiWsXk3qNIvomdlP27H/MNThSlOeFsd/hE:VSUJZdbdCH/shSlOVZE
TLSH:	D3D4010327E8AA1EF47FA7F424611114137A7A17BA73D74D4FE8E1CB1A21B054E62B1B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.............f.... ........@.. ....................... ............@................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x49c066
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF37F2E8A [Mon Jun 15 09:21:14 2099 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9c013	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9e000	0x620	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa0000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x99520	0x70	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x9a06c	0x9a200	ef51eb50e1294e89336ddd8b5fdbfb66	False	0.8867330063868614	data	7.8603183590444825	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x9e000	0x620	0x800	b2700473df96ed14ece9bab955f11d37	False	0.33984375	data	3.471390538284318	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa0000	0xc	0x200	89a5598d525f1c5ff2371fc8771ef23d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x9e090	0x390	data			0.4276315789473684
RT_MANIFEST	0x9e430	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/18/24-14:30:28.601602	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49708	587	192.168.2.8	199.79.62.115
03/18/24-14:30:28.601602	TCP	2855542	ETPRO TROJAN Agent Tesla CnC Exfil Activity	49708	587	192.168.2.8	199.79.62.115
03/18/24-14:30:28.601602	TCP	2855245	ETPRO TROJAN Agent Tesla Exfil via SMTP	49708	587	192.168.2.8	199.79.62.115
03/18/24-14:30:28.601602	TCP	2851779	ETPRO TROJAN Agent Tesla Telegram Exfil	49708	587	192.168.2.8	199.79.62.115
03/18/24-14:30:28.601602	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49708	587	192.168.2.8	199.79.62.115
03/18/24-14:30:28.601602	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49708	587	192.168.2.8	199.79.62.115

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2024 14:30:26.939718962 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:27.112437963 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:27.112546921 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:27.378134012 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:27.378813982 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:27.551665068 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:27.552731037 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:27.725832939 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:27.726944923 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:27.940346003 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:28.067830086 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:28.068140984 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:28.241786003 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:28.241801977 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:28.242046118 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:28.427967072 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:28.428138971 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:28.600712061 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:28.600796938 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:28.601602077 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:28.601602077 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:28.601692915 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:28.601777077 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:30:28.774682045 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:28.775456905 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:30:28.822397947 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:32:06.916631937 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:32:07.129497051 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:32:07.290652037 CET	587	49708	199.79.62.115	192.168.2.8
Mar 18, 2024 14:32:07.290838957 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:32:07.291032076 CET	49708	587	192.168.2.8	199.79.62.115
Mar 18, 2024 14:32:07.463706970 CET	587	49708	199.79.62.115	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2024 14:30:26.565315962 CET	59189	53	192.168.2.8	1.1.1.1
Mar 18, 2024 14:30:26.924618959 CET	53	59189	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 18, 2024 14:30:26.565315962 CET	192.168.2.8	1.1.1.1	0xb14e	Standard query (0)	mail.mbarieservicesltd.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 18, 2024 14:30:26.924618959 CET	1.1.1.1	192.168.2.8	0xb14e	No error (0)	mail.mbarieservicesltd.com	mbarieservicesltd.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2024 14:30:26.924618959 CET	1.1.1.1	192.168.2.8	0xb14e	No error (0)	mbarieservicesltd.com		199.79.62.115	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Mar 18, 2024 14:30:27.378134012 CET	587	49708	199.79.62.115	192.168.2.8	220-md-54.webhostbox.net ESMTP Exim 4.96.2 #2 Mon, 18 Mar 2024 19:00:27 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Mar 18, 2024 14:30:27.378813982 CET	49708	587	192.168.2.8	199.79.62.115	EHLO 760639
Mar 18, 2024 14:30:27.551665068 CET	587	49708	199.79.62.115	192.168.2.8	250-md-54.webhostbox.net Hello 760639 [191.96.227.194] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Mar 18, 2024 14:30:27.552731037 CET	49708	587	192.168.2.8	199.79.62.115	AUTH login c2FsZXNzQG1iYXJpZXNlcnZpY2VzbHRkLmNvbQ==
Mar 18, 2024 14:30:27.725832939 CET	587	49708	199.79.62.115	192.168.2.8	334 UGFzc3dvcmQ6
Mar 18, 2024 14:30:28.067830086 CET	587	49708	199.79.62.115	192.168.2.8	235 Authentication succeeded
Mar 18, 2024 14:30:28.068140984 CET	49708	587	192.168.2.8	199.79.62.115	MAIL FROM:<saless@mbarieservicesltd.com>
Mar 18, 2024 14:30:28.241801977 CET	587	49708	199.79.62.115	192.168.2.8	250 OK
Mar 18, 2024 14:30:28.242046118 CET	49708	587	192.168.2.8	199.79.62.115	RCPT TO:<iinfo@mbarieservicesltd.com>
Mar 18, 2024 14:30:28.427967072 CET	587	49708	199.79.62.115	192.168.2.8	250 Accepted
Mar 18, 2024 14:30:28.428138971 CET	49708	587	192.168.2.8	199.79.62.115	DATA
Mar 18, 2024 14:30:28.600796938 CET	587	49708	199.79.62.115	192.168.2.8	354 Enter message, ending with "." on a line by itself
Mar 18, 2024 14:30:28.601777077 CET	49708	587	192.168.2.8	199.79.62.115	.
Mar 18, 2024 14:30:28.775456905 CET	587	49708	199.79.62.115	192.168.2.8	250 OK id=1rmD4O-000rDB-1f
Mar 18, 2024 14:32:06.916631937 CET	49708	587	192.168.2.8	199.79.62.115	QUIT
Mar 18, 2024 14:32:07.290652037 CET	587	49708	199.79.62.115	192.168.2.8	221 md-54.webhostbox.net closing connection

Target ID:	0
Start time:	14:30:23
Start date:	18/03/2024
Path:	C:\Users\user\Desktop\PO234400.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PO234400.exe
Imagebase:	0xa60000
File size:	634'368 bytes
MD5 hash:	1ED78424905206C4549AC51B97B5120B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.1379891077.00000000040EE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	14:30:24
Start date:	18/03/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PO234400.exe
Imagebase:	0x3b0000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:30:24
Start date:	18/03/2024
Path:	C:\Users\user\Desktop\PO234400.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\PO234400.exe
Imagebase:	0x130000
File size:	634'368 bytes
MD5 hash:	1ED78424905206C4549AC51B97B5120B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	14:30:24
Start date:	18/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:30:24
Start date:	18/03/2024
Path:	C:\Users\user\Desktop\PO234400.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PO234400.exe
Imagebase:	0xe50000
File size:	634'368 bytes
MD5 hash:	1ED78424905206C4549AC51B97B5120B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2607967300.000000000322A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000006.00000002.2606062779.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.2607967300.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.2607967300.00000000031D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	14:30:26
Start date:	18/03/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff605670000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	157
Total number of Limit Nodes:	16

Executed Functions

Function 07B1BAF0 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cf3f4c4a35f86db9c9bfe4194627eb891b60d8724c9884dbf182b13e75d9e72
Instruction ID: c5a931156205807928aafcf8c22de2c59f32c2e3a38ba97637d795da74b24149
Opcode Fuzzy Hash: 1cf3f4c4a35f86db9c9bfe4194627eb891b60d8724c9884dbf182b13e75d9e72
Instruction Fuzzy Hash: 74E1BAF17016058FEB29DB75C454BAFB7F6EF89600F9484ADD1469B290DB34E802CB51

Uniqueness

Uniqueness Score: -1.00%

Function 07B12951 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50a4d47f6932a42d30ba301ecc33f19c384cca80655da3296a387ed764d74995
Instruction ID: 7cf6e4ce8ba4ca70d58be5109b60e544d54c02bc3c1710a18002a2d4b6af9cf1
Opcode Fuzzy Hash: 50a4d47f6932a42d30ba301ecc33f19c384cca80655da3296a387ed764d74995
Instruction Fuzzy Hash: 77410BB1E10219CBEB04CFA9C9447DEFBB6BF89300F55C166D408B7254DB346985CB60

Uniqueness

Uniqueness Score: -1.00%

Function 012CD429 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012CD4B6
GetCurrentThread.KERNEL32 ref: 012CD4F3
GetCurrentProcess.KERNEL32 ref: 012CD530
GetCurrentThreadId.KERNEL32 ref: 012CD589

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ec52930c1a941fa5f618d59fd46ed07c3183b044c3e48e35f93fa1579bfb2198
Instruction ID: 1572706b2501289fd19240a6d7f5042db9913c0debef62bf9ce1a5b7b25fa84d
Opcode Fuzzy Hash: ec52930c1a941fa5f618d59fd46ed07c3183b044c3e48e35f93fa1579bfb2198
Instruction Fuzzy Hash: E35166B09003498FEB14DFAAD548BEEBBF1BF88314F20856DD509A7290DB345945CB65

Uniqueness

Uniqueness Score: -1.00%

Function 012CD438 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012CD4B6
GetCurrentThread.KERNEL32 ref: 012CD4F3
GetCurrentProcess.KERNEL32 ref: 012CD530
GetCurrentThreadId.KERNEL32 ref: 012CD589

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: ad76d14539d7c0206963b19ae2c7c6401dc401dd821838257816e2680fe9bda7
Instruction ID: ee97bc3cc0a0c710f9a9f13a3e17cadf7bc6f0a5c4c68271377e6b53b9d794cf
Opcode Fuzzy Hash: ad76d14539d7c0206963b19ae2c7c6401dc401dd821838257816e2680fe9bda7
Instruction Fuzzy Hash: 3F5137B09003098FDB14DFAAD548BAEBBF1FF88314F20856DD519A7350DB346945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 07B17ED4 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07B18116

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: abfad5575574b858dd53d05099efed63677ce5bdb1a41317d63d4d77b6c66e1f
Instruction ID: a4f3ab541974a40cfd892571cc0f7ebb206286b9c70d3156ef331ed98369a013
Opcode Fuzzy Hash: abfad5575574b858dd53d05099efed63677ce5bdb1a41317d63d4d77b6c66e1f
Instruction Fuzzy Hash: 62A14AB1D0065ACFEB24DF68C8417EEBBB2FF48320F5585A9D808A7240DB759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07B17EE0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07B18116

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a932189fc5c48a00af2604ce362b5275bb9f3586eb71ad10c1fa9c0793cdda98
Instruction ID: 5359f6f06d230c2616516c5cc11d14647d500126dd21ff31aa947d14d082ab1b
Opcode Fuzzy Hash: a932189fc5c48a00af2604ce362b5275bb9f3586eb71ad10c1fa9c0793cdda98
Instruction Fuzzy Hash: EF916CB1D0065ACFEB14DF68C8417EEBBB2FF48320F5585A9D808A7240DB759985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012CADA8 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 012CAFFE

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 0adb76fa8a99f50b0a314c82fe592c5216e64bff57b3c3a0219de377994921ae
Instruction ID: bd769808322bc6665b22ef5174046c17241946c35947ac0ae43dfa1f5d3747ba
Opcode Fuzzy Hash: 0adb76fa8a99f50b0a314c82fe592c5216e64bff57b3c3a0219de377994921ae
Instruction Fuzzy Hash: DC816970A10B0A8FD724DF69D4417AABBF1BF88704F008A2DD246D7651E775E846CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012C44B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012C59C9

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: fd4b1ae37587d5c800844de868db9ea815de23eaf17b7b157310234c0cd46292
Instruction ID: 1f2991f7b536576d8553034ddc98c7bbc44af923281c6b06404da226994beafb
Opcode Fuzzy Hash: fd4b1ae37587d5c800844de868db9ea815de23eaf17b7b157310234c0cd46292
Instruction Fuzzy Hash: 5141E2B0D00719CBEB24DFAAC8847DEBBB5BF89714F20815AD508AB251DB71A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012C590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 012C59C9

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 37a4828a6ef41407544a043f123ad342dc861a2f59e0b58c6ff829ea00ad8fdc
Instruction ID: 8d39ab8ef64e61a11c28ac656cb796f76b972f693af601ad5cb73612c5aea2de
Opcode Fuzzy Hash: 37a4828a6ef41407544a043f123ad342dc861a2f59e0b58c6ff829ea00ad8fdc
Instruction Fuzzy Hash: F64104B0D00719CFEB24DFAAC8847DEBBB5BF85714F20815AD508AB251DB71A946CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07B17C50 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07B17CE8

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 06286c24c0844477f0632395b7280909624c82149a836d960eadcfb32d5159ee
Instruction ID: ab5113abd68906b8d443ef44a822d385fb72961df8e568e239bcf3b17b1d5013
Opcode Fuzzy Hash: 06286c24c0844477f0632395b7280909624c82149a836d960eadcfb32d5159ee
Instruction Fuzzy Hash: 232128B69003199FDB10DFA9C9817EEBBF5FF48320F50842AE959A7240DB789954CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07B17C58 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07B17CE8

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: ca8c49b4183f4138b68b3f7c2a5163ed7b6161adadb15d25cb52e71e29567bf6
Instruction ID: 0510e133edd9bff0a286bed1bfdae1c6a9f6691fbbf4f4d9a7bab13768796079
Opcode Fuzzy Hash: ca8c49b4183f4138b68b3f7c2a5163ed7b6161adadb15d25cb52e71e29567bf6
Instruction Fuzzy Hash: B8212AB19003499FDB10DFA9C881BEEBBF5FF48320F50842AE918A7240DB789554CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B17D40 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07B17DC8

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: bda1d6e4ce2841580a7ef94d3faccf9b1d9de465514c3f2a4bcf0bf800adebb3
Instruction ID: 11025feb0a0de6befd0b99ef5edc1f3d8c572aa58660447450247fe3e2b4a5c3
Opcode Fuzzy Hash: bda1d6e4ce2841580a7ef94d3faccf9b1d9de465514c3f2a4bcf0bf800adebb3
Instruction Fuzzy Hash: DA2128B18003499FDF10DFA9C981BEEBBF5FF48320F50882AE518A7240CB399545CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B17AB8 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07B17B3E

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d0e3b4f6598d9ed45f6f6ffbf6e059604043d298d55c3230ef00250ab097fe14
Instruction ID: a33a247883d86ccb4ee841856ede1f40bb273da3cb1bdf57798e16157f1d5380
Opcode Fuzzy Hash: d0e3b4f6598d9ed45f6f6ffbf6e059604043d298d55c3230ef00250ab097fe14
Instruction Fuzzy Hash: 562137B59003098FEB10DFAAC4817EFBBF4EF58220F54842AD559A7240CB789945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 012CD679 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012CD707

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e883985518c2ee891b6c476201a31357f72acf3051e051fc281844f450b5b380
Instruction ID: 22e24aa80035174ed027f3905a129176a30551d351484d02bda774348bcb3a19
Opcode Fuzzy Hash: e883985518c2ee891b6c476201a31357f72acf3051e051fc281844f450b5b380
Instruction Fuzzy Hash: 5D21E6B5D002499FDB10CFAAD584AEEBFF5FB48320F14811AE954A3350D379A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07B17D48 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07B17DC8

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 391d7d37688f6937abbfff267b7d329196f123c1cea900a78e52285f036382d6
Instruction ID: 27b2c42ea1aca187a4a916294a6715793252210dc530206ec38d87d0e92df1cd
Opcode Fuzzy Hash: 391d7d37688f6937abbfff267b7d329196f123c1cea900a78e52285f036382d6
Instruction Fuzzy Hash: F92128B180034D9FDB10DFAAC880BEEBBF5FF48320F50842AE518A7240CB789500CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B17AC0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07B17B3E

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 45fed51e722ba7cf9a7a4b5603f9939e6bb023d1966c6099a7a65b9d8fde4ee4
Instruction ID: 9dfdfbbf864116a17d6a09c4a354a7400a9f3e2d1148dc02be47e653325851f5
Opcode Fuzzy Hash: 45fed51e722ba7cf9a7a4b5603f9939e6bb023d1966c6099a7a65b9d8fde4ee4
Instruction Fuzzy Hash: 142118B19003099FEB10DFAAC4857EEBBF4EF88224F54842AD559A7240CB789945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 012CD680 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012CD707

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 504b432b2a2e6ac62beb7c3d86a79f870b723b25963cc9a46ffffaa46bab0240
Instruction ID: 39d53ba8335d206b127698a550e26faf58a4838f1ec544812a529e654f7f4766
Opcode Fuzzy Hash: 504b432b2a2e6ac62beb7c3d86a79f870b723b25963cc9a46ffffaa46bab0240
Instruction Fuzzy Hash: BC21C4B590024D9FDB10CFAAD984ADEBFF9FB48720F14841AE918A3350D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 07B17B91 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07B17C06

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 7094dab7ff52a43d3a644369f42f8b792b61178df635d63f6d40da63c2d18553
Instruction ID: 658f8bfbe75c4ce1fc2de3ee7def6bcf10cebdb975aacaaa9da58c6476487c9b
Opcode Fuzzy Hash: 7094dab7ff52a43d3a644369f42f8b792b61178df635d63f6d40da63c2d18553
Instruction Fuzzy Hash: 5E1126B6800249DFDB10DFA9C945BEEBBF5FF48320F14881AE559A7250CB759544CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 012CA168 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,012CB079,00000800,00000000,00000000), ref: 012CB28A

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2e58d0d5ff811e0925f385612e985c42fc0f6f5dcc887c7ba3a424b4b26414a7
Instruction ID: 52ba1b14e8f81315c896120656447229744d5f4d1355dfa4a7d05f52bedd1002
Opcode Fuzzy Hash: 2e58d0d5ff811e0925f385612e985c42fc0f6f5dcc887c7ba3a424b4b26414a7
Instruction Fuzzy Hash: 9D1103B68003099FDB10DF9AC445BAEFBF9EB89720F10852ED619A7200C375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 012CB218 Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,012CB079,00000800,00000000,00000000), ref: 012CB28A

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a259bb194d28043e62e9a08f69f8f8763fa5af50a7f94e711166c8072a8a0199
Instruction ID: ce4ce72287de7416cd3c73045603785bc62f2787162824dd5525b99de7669adf
Opcode Fuzzy Hash: a259bb194d28043e62e9a08f69f8f8763fa5af50a7f94e711166c8072a8a0199
Instruction Fuzzy Hash: 431144B68003498FDB10CFAAC445BEEFBF5AB88720F10841EDA18A7200C375A505CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B17B98 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07B17C06

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: dcc172b4165c2ae5958e324253fb0d6a9531bb8dfcffeb24e3c59bbf3f4acb59
Instruction ID: 0ddf99d1e495e7d948c680e3b8e2c65fc19f9a05f7e85395d20ac20e2668cb2e
Opcode Fuzzy Hash: dcc172b4165c2ae5958e324253fb0d6a9531bb8dfcffeb24e3c59bbf3f4acb59
Instruction Fuzzy Hash: 9A1126B58003499FDB10DFAAC844BEEBBF5EF88320F14881AE515A7250CB759540CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07B17A08 Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07B17A72

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: cf8b2da2caadb423397f7f2ee0fc5b0bbad99908ac2ee6aa99abce13b6ad2864
Instruction ID: eaaea66ec8038bf0ec34f794a0862f07570178197ec4568746fe073b2a5c7c00
Opcode Fuzzy Hash: cf8b2da2caadb423397f7f2ee0fc5b0bbad99908ac2ee6aa99abce13b6ad2864
Instruction Fuzzy Hash: 501158B1C003498FDB10DFAAC4457EEBBF5EB88220F20881AD519A7250CB399645CF90

Uniqueness

Uniqueness Score: -1.00%

Function 07B17A10 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07B17A72

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d27a4389cc1d85057045595f215dad35c0009c610be56942c3eb0380aa166bb2
Instruction ID: 20bbd81bae03adc71dca23eee2498a38ee826b612ae200b5c5869d9dac9ebaf7
Opcode Fuzzy Hash: d27a4389cc1d85057045595f215dad35c0009c610be56942c3eb0380aa166bb2
Instruction Fuzzy Hash: 6F1128B1D003498FDB10DFAAC4457AEFBF9AB88620F24845AD519A7240CB75A544CB94

Uniqueness

Uniqueness Score: -1.00%

Function 07B1A87C Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07B1B065

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0014f4a8012ed69d88f6a74c5db2bf3e1c37262b1be03bf61418bbd84491af6b
Instruction ID: aeef93c1c7fd722d720db1d7223397ee3da6cab4e48437fa990865e5ed143b5c
Opcode Fuzzy Hash: 0014f4a8012ed69d88f6a74c5db2bf3e1c37262b1be03bf61418bbd84491af6b
Instruction Fuzzy Hash: CA11E3B58003499FDB20DF9AC489BDFBBF8FB48720F10845AE514A7200C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012CAF98 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 012CAFFE

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 567583c69b6fb3193eb1a0a642ce1a03b1d45e1f495786fe607b136bb116de4e
Instruction ID: 07cd5a48c90007142413cc7a60d1bd2e39b1e29f4aff3303daaa0335266912f7
Opcode Fuzzy Hash: 567583c69b6fb3193eb1a0a642ce1a03b1d45e1f495786fe607b136bb116de4e
Instruction Fuzzy Hash: DF1113B5C003498FDB14DF9AC444BDEFBF4AB88724F10851AD529A7210D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07B1B000 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 07B1B065

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: f9e76866f9b7e7a8659fe2c8d6cb1b5c4166ef94249657110ff338ef1d4a9b0d
Instruction ID: 9e4111b15fe40e1a8238ed6eb0b0ed37818b1db885442f317d940b62dd1f3e30
Opcode Fuzzy Hash: f9e76866f9b7e7a8659fe2c8d6cb1b5c4166ef94249657110ff338ef1d4a9b0d
Instruction Fuzzy Hash: DB11E0B58003499FDB20DF9AC884BDEBBF8EB48320F24845AE558A7641C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376536439.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ffd000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3447ae3d993e059898b4ae0b05b8477d05c64360068c1d59cf2a7caa037d2cf
Instruction ID: 3050fc874fc35a315c93c8c76a7eaf0054b00735950e6af143a8e5500179c0fe
Opcode Fuzzy Hash: b3447ae3d993e059898b4ae0b05b8477d05c64360068c1d59cf2a7caa037d2cf
Instruction Fuzzy Hash: 89212876504308DFDB04DF10D9C4B26BB66FF94324F20C169DA090B266C336E856EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0100D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376642947.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfcbd1aa7777e916122958230ab913f95130be3fb1c7cd25cc1e1529544dad9a
Instruction ID: 1611bd7ffc5391a6659ef8f79afbdcaad339cfd654b44e4bece940b5151cc227
Opcode Fuzzy Hash: cfcbd1aa7777e916122958230ab913f95130be3fb1c7cd25cc1e1529544dad9a
Instruction Fuzzy Hash: 68212571604300EFEB02DF94D9C0B25BBA1FB94324F20C5ADE8894B282C736D406CB72

Uniqueness

Uniqueness Score: -1.00%

Function 0100D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376642947.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2eb7c3e28b3080cb6ae328941ac7bb3badf04233c4dc0a23616aba99747136f
Instruction ID: 5c120c53c8e006ffea3f3d1ddd8f338abec317db8f14a8e74b0fc122f76d908c
Opcode Fuzzy Hash: c2eb7c3e28b3080cb6ae328941ac7bb3badf04233c4dc0a23616aba99747136f
Instruction Fuzzy Hash: 3121CF756043049FEB16DF94D984B16BBA5EB84224F20C5A9E98E4B286C33AD446CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376536439.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ffd000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction ID: 1d0702240b352fb219a91f6a09f7d55b1c070f9b0f5e8e5d1ce8aeb0fa0d25fe
Opcode Fuzzy Hash: e3062b24f5b0128947100ec6e500ced3c6d63245422b7ec3b5033f72fc324263
Instruction Fuzzy Hash: 5E110376904244CFCB05CF00D5C0B26BF72FF94324F24C2A9D9090B666C33AE856DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0100D017 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376642947.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: bb1012135acf64d8c48323a6a6feca132399cd31976b01ee452f4a5345f2ed0b
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 1E11BE75504280CFDB12CF94D5C4B15BBA2FB44324F24C6AAE8494B696C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0100D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376642947.000000000100D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0100D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_100d000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction ID: c8c86d44b429e725fbb8a604013f87afe0d76a9b81c106ff4b208f444f95d3cc
Opcode Fuzzy Hash: 8009cd9747851c6a16484d38da83a80e1112e09f0888f91abd329c0e09305381
Instruction Fuzzy Hash: 3D11BB75504280DFDB02CF98C5C0B15BBA2FB84224F24C6ADD8894B696C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD759 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376536439.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ffd000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f2cdef6cbe2cf0dd777ad49689a56ebee77c3cd765a1104ee58a8f10b44c72f
Instruction ID: 88806ed9a1f5d985cfbfaf0db68fdf56f9c8293c592fb8e662c185c50182b694
Opcode Fuzzy Hash: 6f2cdef6cbe2cf0dd777ad49689a56ebee77c3cd765a1104ee58a8f10b44c72f
Instruction Fuzzy Hash: 2D01A2734053489BE7206A25CC84B76FFD9EF41735F28C55AEE094E2A6C3799840DBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00FFD758 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1376536439.0000000000FFD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FFD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ffd000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6aad13a327a825f2eb2d99e3bc14a5b0b18a260033078373bd866cc39744088c
Instruction ID: 975d21e395bc07474f0e6e614ecbeb9d1db1f8b3e184a58214c5a1d2532b7643
Opcode Fuzzy Hash: 6aad13a327a825f2eb2d99e3bc14a5b0b18a260033078373bd866cc39744088c
Instruction Fuzzy Hash: D0F062724053489EE7109A16DD84B72FFE8EF51735F18C45AED184F2A6C279A844CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 07B18A30 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f70ba87b75dfc700eebd1c7c0e8414ec5fb696ac35c4bbd81989478172c4a4
Instruction ID: 76ddec34e725ea48621a4468b902f5dcaa14a1d36131de7d09dda1d0f87c5a1f
Opcode Fuzzy Hash: 72f70ba87b75dfc700eebd1c7c0e8414ec5fb696ac35c4bbd81989478172c4a4
Instruction Fuzzy Hash: 32E1FBB4E00219CFDB14DFA8C5909AEFBB2FF89315F2481A9D418AB355D731A942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07B15688 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b24e3b44f25013f2e63603b5f9b5075a45a5c1d9e2c9cec898104947834eda5
Instruction ID: 89d0c7b7717698d465aa922599bc27bd54668f16d5a753d130d2fd85f1775481
Opcode Fuzzy Hash: 3b24e3b44f25013f2e63603b5f9b5075a45a5c1d9e2c9cec898104947834eda5
Instruction Fuzzy Hash: D4E11CB4E00219CFDB24DFA9C580AAEFBB2FF89305F648169D418AB355D731A941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07B171E8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96c381589786575d5263279765805bec6a66f4190968ba44de36bd483335c2b5
Instruction ID: 284ce698b292527ef6689c6b7215b1878bde8e91c3673d2a296c376ebdcc5302
Opcode Fuzzy Hash: 96c381589786575d5263279765805bec6a66f4190968ba44de36bd483335c2b5
Instruction Fuzzy Hash: D2E11DB4E00219CFDB14DFA9C5909AEFBB2FF89305F248169D818A7355DB31A942CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07B15EF8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e886b980beae77ead8bc78bea54c278cc7ac2f399132da0dc24f174092d85f5f
Instruction ID: a83b24c65bfed64961c1206d02d8eb11fdbe7c97d81639a7a9652af06e38d868
Opcode Fuzzy Hash: e886b980beae77ead8bc78bea54c278cc7ac2f399132da0dc24f174092d85f5f
Instruction Fuzzy Hash: 1AE1FCB4E00219CFDB14DFA9C5909AEFBB2FF89305F2481A9D418A7355DB31A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 07B15AC0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ee1c0abd00d79b4f287e489472f7bd27689bfaa275d129641cffb8fd696e8f
Instruction ID: 2ac986546ea9248494effe0ea980dc2e371dd198643d9f9f3202cb9bd26bb1cc
Opcode Fuzzy Hash: c0ee1c0abd00d79b4f287e489472f7bd27689bfaa275d129641cffb8fd696e8f
Instruction Fuzzy Hash: 6CE1FCB4E002198FDB24DF99C5909AEFBB2FF89305F64C169D418AB355D731A941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 012CD364 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1377190570.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_12c0000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68e545555dc20f7cd9b80972cbd397caf1c2a35e0ab0a720cb609373a47ac4bd
Instruction ID: da8e7f8c0d400d60c2fd0958a7178f0baddce99cc17ab40fc6b1d238b01cb5c0
Opcode Fuzzy Hash: 68e545555dc20f7cd9b80972cbd397caf1c2a35e0ab0a720cb609373a47ac4bd
Instruction Fuzzy Hash: 8AA18036E1021A8FCF15DFB4C5405AEBBB3FF84700B25866EEA15AB265DB31D909CB40

Uniqueness

Uniqueness Score: -1.00%

Function 07B15653 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1388192273.0000000007B10000.00000040.00000800.00020000.00000000.sdmp, Offset: 07B10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7b10000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd0399b8e78ca3b9dc21dfd844dc4b1c219d4a677bd897e578009bd9629aa655
Instruction ID: 8c4a944738e353266890ff33317738ecc6fbc2aaa0a3405fd3fa8af7d1a4ca85
Opcode Fuzzy Hash: cd0399b8e78ca3b9dc21dfd844dc4b1c219d4a677bd897e578009bd9629aa655
Instruction Fuzzy Hash: 20513DB0E04219CFDB14DFA9C5545AEBBF2FF89304F2481AAD458AB215D7319A41CFA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PO234400.exePID: 7516, Parent PID: 7276COMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	156
Total number of Limit Nodes:	16

Executed Functions

Function 0691C258 Relevance: 1.7, APIs: 1, Instructions: 196
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2611001531.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6910000_PO234400.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3e5e4e7b78305b3ce61de15494cca85b33096bd2257bec2984712abc68ccafc9
Instruction ID: eb3841f25fb3dd9edd78d807189f294e612a5cbba4acbb35b6c762ee66e13e3e
Opcode Fuzzy Hash: 3e5e4e7b78305b3ce61de15494cca85b33096bd2257bec2984712abc68ccafc9
Instruction Fuzzy Hash: 6D714670A00B09CFDB64DF6AD44475ABBF5FF88204F20892DD49ADBA50D778E846CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0691F9A5 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0691FAC2

Memory Dump Source

Source File: 00000006.00000002.2611001531.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6910000_PO234400.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dff50af6481fe7f75560a2572d56d8324de873898d2f1bfdc29d10ca544469e0
Instruction ID: 1bc3ade7b8fb6ddfc45abee73f540ba33fd87f5fa17c907fb1f3f84194824eab
Opcode Fuzzy Hash: dff50af6481fe7f75560a2572d56d8324de873898d2f1bfdc29d10ca544469e0
Instruction Fuzzy Hash: 0051BFB1D0034D9FDB14CFA9C884ADEBBB5BF88314F24812AE819AB250D775A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0691F9B0 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0691FAC2

Memory Dump Source

Source File: 00000006.00000002.2611001531.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6910000_PO234400.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: dcc3028bd3469a76256a527b2294e17e945307788a851ebb5d6e0783204d89e1
Instruction ID: d6e7096b5c280f3034cee63d788b97e4c64ee69182d93eb989f141d0ffb3f38f
Opcode Fuzzy Hash: dcc3028bd3469a76256a527b2294e17e945307788a851ebb5d6e0783204d89e1
Instruction Fuzzy Hash: C341ADB1D0034D9FDB14CF9AC884ADEBBF5BF88314F24812AE819AB250D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0160C1D8 Relevance: 1.6, APIs: 1, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2607455879.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1600000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4da9162d1b777e2aeb0859bf5e8e38758954e222a11a7f9ee8ec9a9e0cee298
Instruction ID: a3dbadb303c2878f5ab955022baa1f69bbebaf3ad129ec77c34fdc620b9b4bb5
Opcode Fuzzy Hash: c4da9162d1b777e2aeb0859bf5e8e38758954e222a11a7f9ee8ec9a9e0cee298
Instruction Fuzzy Hash: FC41B3786463449FE715CF65E988A693BB3FF88311F204169EA518BBC6DB380941CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0691C7E8 Relevance: 1.6, APIs: 1, Instructions: 63
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 0691C85A

Memory Dump Source

Source File: 00000006.00000002.2611001531.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6910000_PO234400.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f7c05064a5e342394a8d676d5684699f7c7931f8abc7facac41e679459356e33
Instruction ID: dd1a13d8cfb9a27485873b61c4b975167cee8663b256d0b7d4bddf2f153c9927
Opcode Fuzzy Hash: f7c05064a5e342394a8d676d5684699f7c7931f8abc7facac41e679459356e33
Instruction Fuzzy Hash: 182118B6D003099FDB10DF9AD844ADEFBF8EB88320F20802AD515A7600C779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0160C110 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0160C19F

Memory Dump Source

Source File: 00000006.00000002.2607455879.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1600000_PO234400.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 2923663e7de625834149537683cd6727f6bcfa46430fa3cda549371bdb405e71
Instruction ID: d4957a0bb81b191d4f135e966a160a8acc340ffc6453e84341675fb3d46075d3
Opcode Fuzzy Hash: 2923663e7de625834149537683cd6727f6bcfa46430fa3cda549371bdb405e71
Instruction Fuzzy Hash: E621E2B5D002499FDB10CFAAD884AEEBFF5FB48311F24845AE918A3750C378A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0160C118 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0160C19F

Memory Dump Source

Source File: 00000006.00000002.2607455879.0000000001600000.00000040.00000800.00020000.00000000.sdmp, Offset: 01600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1600000_PO234400.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d10dedfad26f99da47c527bbda229c5f5417a154b6831a5005c6edb7070ff157
Instruction ID: 520fd8b2ee97ef6f32253bfae6d83c3da1757489bdea66790d4a1669a2d796a7
Opcode Fuzzy Hash: d10dedfad26f99da47c527bbda229c5f5417a154b6831a5005c6edb7070ff157
Instruction Fuzzy Hash: 6D21C4B59002499FDB10CFAAD884ADEFFF9FB48310F14845AE954A3350D378A954CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0691C7F0 Relevance: 1.6, APIs: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 0691C85A

Memory Dump Source

Source File: 00000006.00000002.2611001531.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6910000_PO234400.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fa18f7d4fa6d86fb4e99fb6ac3e01882f886d9934ca04d6cd084e7b4c70f610f
Instruction ID: f60c5b25edc3900022b554278269349bf2904dbac2b4f78b9c101003d240b51d
Opcode Fuzzy Hash: fa18f7d4fa6d86fb4e99fb6ac3e01882f886d9934ca04d6cd084e7b4c70f610f
Instruction Fuzzy Hash: 4611E4B6D003498FDB10CF9AC484ADEFBF8AB89710F20842ED519A7610C779A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 069195C0 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0691C274), ref: 0691C4AE

Memory Dump Source

Source File: 00000006.00000002.2611001531.0000000006910000.00000040.00000800.00020000.00000000.sdmp, Offset: 06910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6910000_PO234400.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 43eff9b1243faec42d9ff68f09971144ba41ecd31c2260f1996406d8981e6926
Instruction ID: 2b0fb7dfc9d6e66cf949c7ce88b7802a62c31635cf615bee83e7ab358211b2bd
Opcode Fuzzy Hash: 43eff9b1243faec42d9ff68f09971144ba41ecd31c2260f1996406d8981e6926
Instruction Fuzzy Hash: 391102B5C04349CFDB10DF9AC444BEEFBF4EB88214F20841AD519A7650C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 015AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2607170773.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15ad000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07116e2ccfb95790203b0ad8b30cc34d145a6f9155f6bf4a120a344010b31fc
Instruction ID: 01d636641c4dacb121fc900bc14311015495d40728de068f27854c37049b0abe
Opcode Fuzzy Hash: d07116e2ccfb95790203b0ad8b30cc34d145a6f9155f6bf4a120a344010b31fc
Instruction Fuzzy Hash: 65214275284300DFDB10EF64D884B2ABBB1FB88314F60C96DD80A0F682D33AC407CA62

Uniqueness

Uniqueness Score: -1.00%

Function 015AD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2607170773.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_15ad000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f63bd1e8f23bdce96bd7a7a19a865803ae1361a2bb2f3ec4fa3663416eac71
Instruction ID: 88d5e63051f788631368807e32aac081c72f5da5a316e618808fc9f31403b15f
Opcode Fuzzy Hash: c3f63bd1e8f23bdce96bd7a7a19a865803ae1361a2bb2f3ec4fa3663416eac71
Instruction Fuzzy Hash: 8021A1755493808FCB03DF24D990719BF71FB46214F28C5EAD8498F6A7C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0159D628 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2607116396.000000000159D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0159D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_159d000_PO234400.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 679b9486f5dbbb28dee72361c1236369dd800c56e464452b8f87f5ed2b0ed9a5
Instruction ID: fd7f37e4e1b729ddcf527964a9877b4580095d510a9789dcc028b9963f68027e
Opcode Fuzzy Hash: 679b9486f5dbbb28dee72361c1236369dd800c56e464452b8f87f5ed2b0ed9a5
Instruction Fuzzy Hash: 49F06271404344AEEB108E1AD884B66FFA8EB45635F18C45AED4C4E297C379A844CAB2

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PO234400.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO234400.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5m1c2nii.nam.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a05r2hnr.pls.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fp35rzaj.cbr.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hdyvhbvf.dsv.psm1

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Windows Analysis Report
PO234400.exe

Function 012CD429 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Function 012CD438 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Function 07B17ED4 Relevance: 1.7, APIs: 1, Instructions: 249
processCOMMON

Function 07B17EE0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 012CADA8 Relevance: 1.7, APIs: 1, Instructions: 209
COMMON

Function 012C44B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 012C590C Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Function 07B17C50 Relevance: 1.6, APIs: 1, Instructions: 71
injectionCOMMON

Function 07B17C58 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 07B17D40 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Function 07B17AB8 Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Function 012CD679 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Function 07B17D48 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 07B17AC0 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 012CD680 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre