Edit tour

Windows Analysis Report
Eaton PO-45150292964.exe

Overview

General Information

Sample name:	Eaton PO-45150292964.exe
Analysis ID:	1427169
MD5:	3a64b763c78291700bd114bfc3ecdde3
SHA1:	7260be2d4cf3fbcf231e94a84c8f3cf252163c89
SHA256:	8bbfa40764eabafad6f90d973784f343b8d7146689f4fd4384da26935b2bca5e
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Contains functionality to inject code into remote processes

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Eaton PO-45150292964.exe (PID: 6620 cmdline: "C:\Users\user\Desktop\Eaton PO-45150292964.exe" MD5: 3A64B763C78291700BD114BFC3ECDDE3)

Eaton PO-45150292964.exe (PID: 2764 cmdline: "C:\Users\user\Desktop\Eaton PO-45150292964.exe" MD5: 3A64B763C78291700BD114BFC3ECDDE3)

WerFault.exe (PID: 2892 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 80 MD5: C31336C1EFC2CCB44B4326EA793040F2)

Eaton PO-45150292964.exe (PID: 4512 cmdline: "C:\Users\user\Desktop\Eaton PO-45150292964.exe" MD5: 3A64B763C78291700BD114BFC3ECDDE3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Host": "mail.iaa-airferight.com", "Username": "mail@iaa-airferight.com", "Password": "Asaprocky11"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.4451010775.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000006.00000002.4451010775.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.4451010775.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Eaton PO-45150292964.exe PID: 6620	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Eaton PO-45150292964.exe PID: 6620	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Eaton PO-45150292964.exe PID: 4512	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Eaton PO-45150292964.exe PID: 4512	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Eaton PO-45150292964.exe.4b10000.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Eaton PO-45150292964.exe.4b10000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Eaton PO-45150292964.exe.4b10000.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31769:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31885:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31961:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a87:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Eaton PO-45150292964.exe.3713540.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Eaton PO-45150292964.exe.3713540.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Eaton PO-45150292964.exe.3713540.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.Eaton PO-45150292964.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.Eaton PO-45150292964.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.Eaton PO-45150292964.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Eaton PO-45150292964.exe.36d8b10.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Eaton PO-45150292964.exe.36d8b10.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Eaton PO-45150292964.exe.36d8b10.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31769:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31885:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31961:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a87:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Eaton PO-45150292964.exe.3713540.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Eaton PO-45150292964.exe.3713540.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Eaton PO-45150292964.exe.3713540.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31769:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31885:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31961:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a87:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Eaton PO-45150292964.exe.36d8b10.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Eaton PO-45150292964.exe.36d8b10.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Eaton PO-45150292964.exe.36d8b10.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334f7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6df27:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33569:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6df99:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335f3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6e023:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33685:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6e0b5:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336ef:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6e11f:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33761:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6e191:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337f7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6e227:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33887:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6e2b7:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 46.175.148.58, DestinationIsIpv6: false, DestinationPort: 25, EventID: 3, Image: C:\Users\user\Desktop\Eaton PO-45150292964.exe, Initiated: true, ProcessId: 4512, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49706

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Host": "mail.iaa-airferight.com", "Username": "mail@iaa-airferight.com", "Password": "Asaprocky11"}

Multi AV Scanner detection for submitted file

Source: Eaton PO-45150292964.exe	ReversingLabs: Detection: 39%
Source: Eaton PO-45150292964.exe	Virustotal: Detection: 52%			Perma Link

Machine Learning detection for sample

Source: Eaton PO-45150292964.exe

Joe Sandbox ML: detected

Source: Eaton PO-45150292964.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49705 version: TLS 1.2

Source: Eaton PO-45150292964.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 46.175.148.58 46.175.148.58

Source: Joe Sandbox View

ASN Name: ASLAGIDKOM-NETUA ASLAGIDKOM-NETUA

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.5:49706 -> 46.175.148.58:25

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: Eaton PO-45150292964.exe, 00000006.00000002.4451010775.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.iaa-airferight.com
Source: Eaton PO-45150292964.exe, 00000006.00000002.4451010775.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Eaton PO-45150292964.exe, 00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp, Eaton PO-45150292964.exe, 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, Eaton PO-45150292964.exe, 00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Eaton PO-45150292964.exe, 00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp, Eaton PO-45150292964.exe, 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, Eaton PO-45150292964.exe, 00000006.00000002.4451010775.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Eaton PO-45150292964.exe, 00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: Eaton PO-45150292964.exe, 00000006.00000002.4451010775.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: Eaton PO-45150292964.exe, 00000006.00000002.4451010775.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.5:49705 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, abAX9N.cs	.Net Code: BFeixnEv
Source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.raw.unpack, abAX9N.cs	.Net Code: BFeixnEv
Source: 0.2.Eaton PO-45150292964.exe.3713540.1.raw.unpack, abAX9N.cs	.Net Code: BFeixnEv

Installs a global keyboard hook

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Windows user hook set: 0 keyboard low level C:\Users\user\Desktop\Eaton PO-45150292964.exe

Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Eaton PO-45150292964.exe.3713540.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.Eaton PO-45150292964.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Eaton PO-45150292964.exe.3713540.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 0_2_04A50054 CreateProcessW,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,		0_2_04A50054
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 0_2_04A50000 CreateProcessW,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,		0_2_04A50000

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_00FD4A98	6_2_00FD4A98
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_00FDADF0	6_2_00FDADF0
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_00FD3E80	6_2_00FD3E80
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_00FD41C8	6_2_00FD41C8
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_06683578	6_2_06683578
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_06685D30	6_2_06685D30
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_066845A0	6_2_066845A0
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_06681030	6_2_06681030
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_0668E0B9	6_2_0668E0B9
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_0668A140	6_2_0668A140
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_066891E0	6_2_066891E0
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_06685650	6_2_06685650
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_0668C618	6_2_0668C618
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_06683C8F	6_2_06683C8F
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_06680328	6_2_06680328

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 80

Source: Eaton PO-45150292964.exe, 00000000.00000002.1994771331.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Eaton PO-45150292964.exe
Source: Eaton PO-45150292964.exe, 00000000.00000000.1967800956.0000000000298000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamecBvCffO.exe< vs Eaton PO-45150292964.exe
Source: Eaton PO-45150292964.exe, 00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs Eaton PO-45150292964.exe
Source: Eaton PO-45150292964.exe, 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs Eaton PO-45150292964.exe
Source: Eaton PO-45150292964.exe, 00000006.00000002.4449730524.0000000000CF9000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Eaton PO-45150292964.exe
Source: Eaton PO-45150292964.exe, 00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename8854fa4e-ee03-4899-b0c3-2df80b3f7614.exe4 vs Eaton PO-45150292964.exe
Source: Eaton PO-45150292964.exe	Binary or memory string: OriginalFilenamecBvCffO.exe< vs Eaton PO-45150292964.exe

Source: Eaton PO-45150292964.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Eaton PO-45150292964.exe.3713540.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.Eaton PO-45150292964.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Eaton PO-45150292964.exe.3713540.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: Eaton PO-45150292964.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Eaton PO-45150292964.exe, tyFJ.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, RsYAkkzVoy.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, Kqqzixk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, xROdzGigX.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, ywes.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, iPVW0zV.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, 1Pi9sgbHwoV.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, YUgDfWK2g4.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/0@2/2

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2764

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\52feed5b-8ffe-4cd1-8d8a-78dfd9832551

Jump to behavior

Source: Eaton PO-45150292964.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Eaton PO-45150292964.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Eaton PO-45150292964.exe	ReversingLabs: Detection: 39%
Source: Eaton PO-45150292964.exe	Virustotal: Detection: 52%

Source: unknown	Process created: C:\Users\user\Desktop\Eaton PO-45150292964.exe "C:\Users\user\Desktop\Eaton PO-45150292964.exe"
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process created: C:\Users\user\Desktop\Eaton PO-45150292964.exe "C:\Users\user\Desktop\Eaton PO-45150292964.exe"
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 80
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process created: C:\Users\user\Desktop\Eaton PO-45150292964.exe "C:\Users\user\Desktop\Eaton PO-45150292964.exe"
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process created: C:\Users\user\Desktop\Eaton PO-45150292964.exe "C:\Users\user\Desktop\Eaton PO-45150292964.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process created: C:\Users\user\Desktop\Eaton PO-45150292964.exe "C:\Users\user\Desktop\Eaton PO-45150292964.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Section loaded: edputil.dll	Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Eaton PO-45150292964.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Eaton PO-45150292964.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 0_2_00C30015 push ss; ret	0_2_00C3001E
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_00FD0B4D push edi; ret	6_2_00FD0CC2
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Code function: 6_2_00FD0C95 push edi; retf	6_2_00FD0C3A

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: download (129).png

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Memory allocated: C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Memory allocated: 2560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Memory allocated: 4560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Memory allocated: FD0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Memory allocated: 2C90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Memory allocated: 2A10000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Window / User API: threadDelayed 649			Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Window / User API: threadDelayed 9211			Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 3732	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 5356	Thread sleep count: 200 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 5356	Thread sleep count: 100 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -26747778906878833s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -100000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 2716	Thread sleep count: 649 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -99890s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 2716	Thread sleep count: 9211 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -99780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -99671s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -99562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -99453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -99344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -99234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -99125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -99015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -98906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -98797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -98687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -98578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -98467s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -98359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -98250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -98140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -98031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -97922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -97797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -97687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -97578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -97468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -97359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -97250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -97140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -97031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -96922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -96797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -96687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -96578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -96469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -96344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -96234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -96125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -96015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -95906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -95797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -95687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -95578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -95468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -95359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -95250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -95140s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -95031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -94922s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -94811s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -94699s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe TID: 6760	Thread sleep time: -94594s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 99890	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 99780	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 99671	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 99453	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 99344	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 99234	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 99125	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 99015	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 98906	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 98797	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 98687	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 98578	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 98467	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 98359	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 98250	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 98140	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 98031	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 97922	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 97797	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 97687	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 97578	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 97468	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 97359	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 97250	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 97140	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 97031	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 96922	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 96797	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 96687	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 96578	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 96469	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 96344	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 96234	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 96125	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 96015	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 95906	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 95797	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 95687	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 95578	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 95468	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 95359	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 95250	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 95140	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 95031	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 94922	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 94811	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 94699	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Thread delayed: delay time: 94594	Jump to behavior

Source: Eaton PO-45150292964.exe, 00000006.00000002.4450149868.0000000000EDF000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Code function: 0_2_04A50054 CreateProcessW,NtUnmapViewOfSection,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,

0_2_04A50054

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Memory written: C:\Users\user\Desktop\Eaton PO-45150292964.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process created: C:\Users\user\Desktop\Eaton PO-45150292964.exe "C:\Users\user\Desktop\Eaton PO-45150292964.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Process created: C:\Users\user\Desktop\Eaton PO-45150292964.exe "C:\Users\user\Desktop\Eaton PO-45150292964.exe"			Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Queries volume information: C:\Users\user\Desktop\Eaton PO-45150292964.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Queries volume information: C:\Users\user\Desktop\Eaton PO-45150292964.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.4b10000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.3713540.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Eaton PO-45150292964.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.3713540.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4451010775.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4451010775.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Eaton PO-45150292964.exe PID: 6620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eaton PO-45150292964.exe PID: 4512, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Eaton PO-45150292964.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.4b10000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.3713540.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Eaton PO-45150292964.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.3713540.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4451010775.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Eaton PO-45150292964.exe PID: 6620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eaton PO-45150292964.exe PID: 4512, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.4b10000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.3713540.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.Eaton PO-45150292964.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.4b10000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.3713540.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Eaton PO-45150292964.exe.36d8b10.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.4451010775.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.4451010775.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Eaton PO-45150292964.exe PID: 6620, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Eaton PO-45150292964.exe PID: 4512, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	211 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	24 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	121 Security Software Discovery	Distributed Component Object Model	21 Input Capture	23 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	151 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	211 Process Injection	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Eaton PO-45150292964.exe	39%	ReversingLabs	Win32.Ransomware.Loki
Eaton PO-45150292964.exe	52%	Virustotal		Browse
Eaton PO-45150292964.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
mail.iaa-airferight.com	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://mail.iaa-airferight.com	3%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.iaa-airferight.com	46.175.148.58	true	true	3%, Virustotal, Browse	unknown
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org	Eaton PO-45150292964.exe, 00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp, Eaton PO-45150292964.exe, 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, Eaton PO-45150292964.exe, 00000006.00000002.4451010775.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Eaton PO-45150292964.exe, 00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://account.dyn.com/	Eaton PO-45150292964.exe, 00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp, Eaton PO-45150292964.exe, 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, Eaton PO-45150292964.exe, 00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.ipify.org/t	Eaton PO-45150292964.exe, 00000006.00000002.4451010775.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Eaton PO-45150292964.exe, 00000006.00000002.4451010775.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mail.iaa-airferight.com	Eaton PO-45150292964.exe, 00000006.00000002.4451010775.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
46.175.148.58	mail.iaa-airferight.com	Ukraine		56394	ASLAGIDKOM-NETUA	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1427169
Start date and time:	2024-04-17 07:13:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Eaton PO-45150292964.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/0@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 67 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:13:50	API Interceptor	13232174x Sleep call for process: Eaton PO-45150292964.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Sky-Beta.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	SecuriteInfo.com.Backdoor.Win32.Agent.myuuxz.13708.17224.exe	Get hash	malicious	Bunny Loader	Browse	api.ipify.org/
	lods.cmd	Get hash	malicious	Remcos	Browse	api.ipify.org/
46.175.148.58	remittance payment of invoice DMWW24009.exe	Get hash	malicious	AgentTesla	Browse
	Proforma Invoice - Well Ergon.exe	Get hash	malicious	AgentTesla	Browse
	PURCHASE ORDER.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.14523.13498.exe	Get hash	malicious	AgentTesla	Browse
	order Depeng POORD20231109001.exe	Get hash	malicious	AgentTesla	Browse
	Swift_copy.pdf (2).exe	Get hash	malicious	AgentTesla	Browse
	Swift Copy.exe	Get hash	malicious	AgentTesla	Browse
	purchase_order T&B19-20PO128.pdf.exe	Get hash	malicious	AgentTesla	Browse
	Booking Form PIF.scr.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
mail.iaa-airferight.com	remittance payment of invoice DMWW24009.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Proforma Invoice - Well Ergon.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PURCHASE ORDER.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.PWSX-gen.14523.13498.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	order Depeng POORD20231109001.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Swift_copy.pdf (2).exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Swift Copy.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	purchase_order T&B19-20PO128.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Booking Form PIF.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Outstanding_Invoice_For_PI91328.rar.exe	Get hash	malicious	AgentTesla	Browse	84.54.23.97
api.ipify.org	45brrQrxwH.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	msXkgFIUyS.rtf	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	remittance payment of invoice DMWW24009.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	NOA, BL and invoice.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://worker-royal-sun-1090.nipocas604.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	z158xIuvhauCQiddTe.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	z34PDnVzyEItkXaInw.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://webex-install.com	Get hash	malicious	NetSupport RAT	Browse	104.26.13.205
	SecuriteInfo.com.Win64.PWSX-gen.6289.18727.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer	Browse	172.67.74.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	hcjt7Ajt5t.exe	Get hash	malicious	LummaC	Browse	172.67.217.241
	45brrQrxwH.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	3otr19d5Oq.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.77.31
	msXkgFIUyS.rtf	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	http://bookstopbuzz.com	Get hash	malicious	Unknown	Browse	23.227.38.65
	remittance payment of invoice DMWW24009.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	172.67.177.98
	NOA, BL and invoice.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Hays_compiled_documents.ZIP.js	Get hash	malicious	Unknown	Browse	104.21.95.148
ASLAGIDKOM-NETUA	remittance payment of invoice DMWW24009.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Proforma Invoice - Well Ergon.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	PURCHASE ORDER.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	SecuriteInfo.com.Win32.PWSX-gen.14523.13498.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	order Depeng POORD20231109001.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Swift_copy.pdf (2).exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Swift Copy.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	purchase_order T&B19-20PO128.pdf.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	Booking Form PIF.scr.exe	Get hash	malicious	AgentTesla	Browse	46.175.148.58
	vegpadg6oW.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, PureLog Stealer, RedLine, SmokeLoader	Browse	46.175.144.56

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	45brrQrxwH.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Quotation 0048484.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	remittance payment of invoice DMWW24009.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	2llKbb9pR7.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	104.26.12.205
	NOA, BL and invoice.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Hays_compiled_documents.ZIP.js	Get hash	malicious	Unknown	Browse	104.26.12.205
	MdeeRbWvqe.exe	Get hash	malicious	LummaC, Babuk, Djvu, LummaC Stealer, RedLine, SmokeLoader	Browse	104.26.12.205
	bCsfnThSOV.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.12.205
	bCsfnThSOV.exe	Get hash	malicious	Phemedrone Stealer	Browse	104.26.12.205
	z158xIuvhauCQiddTe.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.277596623778398
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Eaton PO-45150292964.exe
File size:	567'296 bytes
MD5:	3a64b763c78291700bd114bfc3ecdde3
SHA1:	7260be2d4cf3fbcf231e94a84c8f3cf252163c89
SHA256:	8bbfa40764eabafad6f90d973784f343b8d7146689f4fd4384da26935b2bca5e
SHA512:	87bdf6073e722cca6919d3b63a2483d4066388762baf127e10d347fdc1f9c04d168df63d858557a864f508160f43935635c11b7910fafac5c82f6f661363b9e0
SSDEEP:	12288:bPOq1+u42964kZGQLd6yG6I+GAdP7r9r/+pppppppppppppppppppppppppppppb:bPdlMRZGyd9Z1q
TLSH:	90C48CC0E98566A0ED59AB356A36CD3542237EFDA874A41D28DE3D273FFB3931022153
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3..f.................R...T.......p... ........@.. ....................................@................................

File Icon


Icon Hash:	c5a484988c94a04b

Static PE Info

General

Entrypoint:	0x45700e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x661F1133 [Wed Apr 17 00:00:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x56fb4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x58000	0x35004	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x55014	0x55200	54d391401da5f92e06496553852519ac	False	0.7384963518722467	SysEx File -	6.214684962548715	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x58000	0x35004	0x35200	0c3e512fd03aa067ce13aa9e47cfc4b0	False	0.2096920955882353	data	4.457481043915203	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8e000	0xc	0x200	bd7e376c985099cc5aee7a86630d4799	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x58460	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	0.3225609756097561
RT_ICON	0x58ac8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	0.43951612903225806
RT_ICON	0x58db0	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	0.4016393442622951
RT_ICON	0x58f98	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	0.4831081081081081
RT_ICON	0x590c0	0x35e0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9907192575406032
RT_ICON	0x5c6a0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	0.4584221748400853
RT_ICON	0x5d548	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	0.47382671480144406
RT_ICON	0x5ddf0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	0.45564516129032256
RT_ICON	0x5e4b8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	0.3504335260115607
RT_ICON	0x5ea20	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	0.07868508221933042
RT_ICON	0x6f248	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	0.15114568005045195
RT_ICON	0x786f0	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	0.1543233082706767
RT_ICON	0x7eed8	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	0.175184842883549
RT_ICON	0x84360	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	0.15948275862068967
RT_ICON	0x88588	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	0.24107883817427386
RT_ICON	0x8ab30	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	0.2678236397748593
RT_ICON	0x8bbd8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	0.37459016393442623
RT_ICON	0x8c560	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	0.42819148936170215
RT_GROUP_ICON	0x8c9c8	0x102	data	0.5775193798449613
RT_VERSION	0x8cacc	0x34c	data	0.4146919431279621
RT_MANIFEST	0x8ce18	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 07:13:50.694330931 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 17, 2024 07:13:50.694423914 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 17, 2024 07:13:50.694636106 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 17, 2024 07:13:50.700783968 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 17, 2024 07:13:50.700820923 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 17, 2024 07:13:50.921248913 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 17, 2024 07:13:50.921516895 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 17, 2024 07:13:50.923881054 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 17, 2024 07:13:50.923907042 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 17, 2024 07:13:50.924175978 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 17, 2024 07:13:50.974773884 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 17, 2024 07:13:50.984734058 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 17, 2024 07:13:51.032113075 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 17, 2024 07:13:51.224271059 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 17, 2024 07:13:51.224334955 CEST	443	49705	104.26.12.205	192.168.2.5
Apr 17, 2024 07:13:51.224410057 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 17, 2024 07:13:51.239022017 CEST	49705	443	192.168.2.5	104.26.12.205
Apr 17, 2024 07:13:51.889219999 CEST	49706	25	192.168.2.5	46.175.148.58
Apr 17, 2024 07:13:52.896576881 CEST	49706	25	192.168.2.5	46.175.148.58
Apr 17, 2024 07:13:54.896564007 CEST	49706	25	192.168.2.5	46.175.148.58
Apr 17, 2024 07:13:58.917332888 CEST	49706	25	192.168.2.5	46.175.148.58
Apr 17, 2024 07:14:06.943523884 CEST	49706	25	192.168.2.5	46.175.148.58

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 17, 2024 07:13:50.583564043 CEST	61977	53	192.168.2.5	1.1.1.1
Apr 17, 2024 07:13:50.688230991 CEST	53	61977	1.1.1.1	192.168.2.5
Apr 17, 2024 07:13:51.761445045 CEST	63427	53	192.168.2.5	1.1.1.1
Apr 17, 2024 07:13:51.888370991 CEST	53	63427	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 17, 2024 07:13:50.583564043 CEST	192.168.2.5	1.1.1.1	0xcf43	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 17, 2024 07:13:51.761445045 CEST	192.168.2.5	1.1.1.1	0xbf26	Standard query (0)	mail.iaa-airferight.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 17, 2024 07:13:50.688230991 CEST	1.1.1.1	192.168.2.5	0xcf43	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 17, 2024 07:13:50.688230991 CEST	1.1.1.1	192.168.2.5	0xcf43	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 17, 2024 07:13:50.688230991 CEST	1.1.1.1	192.168.2.5	0xcf43	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 17, 2024 07:13:51.888370991 CEST	1.1.1.1	192.168.2.5	0xbf26	No error (0)	mail.iaa-airferight.com	46.175.148.58	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.26.12.205	443	4512	C:\Users\user\Desktop\Eaton PO-45150292964.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-17 05:13:50 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-17 05:13:51 UTC	211	IN	HTTP/1.1 200 OK Date: Wed, 17 Apr 2024 05:13:51 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8759ed9e780944dc-ATL
2024-04-17 05:13:51 UTC	12	IN	Data Raw: 38 31 2e 31 38 31 2e 35 37 2e 35 32 Data Ascii: 81.181.57.52

Target ID:	0
Start time:	07:13:47
Start date:	17/04/2024
Path:	C:\Users\user\Desktop\Eaton PO-45150292964.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Eaton PO-45150292964.exe"
Imagebase:	0x240000
File size:	567'296 bytes
MD5 hash:	3A64B763C78291700BD114BFC3ECDDE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1996509099.0000000004B10000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1995567829.0000000003564000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:13:47
Start date:	17/04/2024
Path:	C:\Users\user\Desktop\Eaton PO-45150292964.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Eaton PO-45150292964.exe"
Imagebase:	0x2d0000
File size:	567'296 bytes
MD5 hash:	3A64B763C78291700BD114BFC3ECDDE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:13:48
Start date:	17/04/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 80
Imagebase:	0x2c0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:13:49
Start date:	17/04/2024
Path:	C:\Users\user\Desktop\Eaton PO-45150292964.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Eaton PO-45150292964.exe"
Imagebase:	0x7f0000
File size:	567'296 bytes
MD5 hash:	3A64B763C78291700BD114BFC3ECDDE3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.4451010775.0000000002D0C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.4449526095.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.4451010775.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.4451010775.0000000002CE1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	36.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	55.8%
Total number of Nodes:	113
Total number of Limit Nodes:	0

Executed Functions

Function 04A50000 Relevance: 13.9, APIs: 9, Instructions: 352
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04A50054: CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,00000042,0000002A,0000002E,?,16B3FE88,00000000), ref: 04A50167

NtUnmapViewOfSection.NTDLL(?,?,0000002E,00000022,?,F21037D0,00000012,?,00000000,00000000,00000000,00000000,00000004,00000000,00000000), ref: 04A50192
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040,0000002E,00000022,?,6E1A959C,00000000,?,?,0000002E,00000022,?,F21037D0), ref: 04A501C9
WriteProcessMemory.KERNELBASE ref: 04A50217
WriteProcessMemory.KERNELBASE(00000026,0000003E,00000026,?,CF14E85B,00000012), ref: 04A502FD
Wow64GetThreadContext.KERNEL32(?,?,0000002E,00000032,?,68A7C7D2,00000000,00000032,0000003A,00000036,?,CF14E85B,00000012), ref: 04A50355
WriteProcessMemory.KERNELBASE(?,68A7C7D2,00000000,00000032,0000003A,00000036,?,CF14E85B,00000012), ref: 04A503A1
Wow64SetThreadContext.KERNEL32(?,?,0000002E,00000032,?,E8A7C7D3,00000000,00000032,00000022,?,68A7C7D2,00000000,00000032,0000003A,00000036), ref: 04A503EC
ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000,?,0000002E,00000032,?,E8A7C7D3,00000000,00000032,00000022,?,68A7C7D2,00000000), ref: 04A5040C

Memory Dump Source

Source File: 00000000.00000002.1996028333.0000000004A50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a50000_Eaton PO-45150292964.jbxd

Similarity

API ID: Process$MemoryThreadWrite$ContextWow64$AllocCreateResumeSectionUnmapViewVirtual
String ID:
API String ID: 2814188497-0
Opcode ID: 475579a4da51060551cf1a565a06ecb6062e12be4c39a443bcd9d84050d1d347
Instruction ID: 9c6ee690607399527f5e6b209696fdd910028e1648fde6f5a0f1d18834eedd2f
Opcode Fuzzy Hash: 475579a4da51060551cf1a565a06ecb6062e12be4c39a443bcd9d84050d1d347
Instruction Fuzzy Hash: 21B109746D8244BFF61577B19F06F2937359FA6B0CF1480A9EA006F1F3C9B278218662

Uniqueness

Uniqueness Score: -1.00%

Function 04A50054 Relevance: 13.8, APIs: 9, Instructions: 322
threadinjectionprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 04A50420: VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,04A50083,0000003C,0000001E,0000004A,0000003E,00000042), ref: 04A5043F

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,00000042,0000002A,0000002E,?,16B3FE88,00000000), ref: 04A50167
NtUnmapViewOfSection.NTDLL(?,?,0000002E,00000022,?,F21037D0,00000012,?,00000000,00000000,00000000,00000000,00000004,00000000,00000000), ref: 04A50192
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040,0000002E,00000022,?,6E1A959C,00000000,?,?,0000002E,00000022,?,F21037D0), ref: 04A501C9
WriteProcessMemory.KERNELBASE ref: 04A50217
WriteProcessMemory.KERNELBASE(00000026,0000003E,00000026,?,CF14E85B,00000012), ref: 04A502FD
Wow64GetThreadContext.KERNEL32(?,?,0000002E,00000032,?,68A7C7D2,00000000,00000032,0000003A,00000036,?,CF14E85B,00000012), ref: 04A50355
WriteProcessMemory.KERNELBASE(?,68A7C7D2,00000000,00000032,0000003A,00000036,?,CF14E85B,00000012), ref: 04A503A1
Wow64SetThreadContext.KERNEL32(?,?,0000002E,00000032,?,E8A7C7D3,00000000,00000032,00000022,?,68A7C7D2,00000000,00000032,0000003A,00000036), ref: 04A503EC
ResumeThread.KERNELBASE(?,0000002E,?,9E4A3F88,00000000,?,0000002E,00000032,?,E8A7C7D3,00000000,00000032,00000022,?,68A7C7D2,00000000), ref: 04A5040C

Memory Dump Source

Source File: 00000000.00000002.1996028333.0000000004A50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a50000_Eaton PO-45150292964.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtualWow64$CreateResumeSectionUnmapView
String ID:
API String ID: 4009322845-0
Opcode ID: abefd893c78f63ec501357fb14bf61d80a739cae84c00b71e3bd370fcc70d613
Instruction ID: e2e1c1c7f87e8d6c98901f61118f9dc133cfa63896666a5e77a58be95032c667
Opcode Fuzzy Hash: abefd893c78f63ec501357fb14bf61d80a739cae84c00b71e3bd370fcc70d613
Instruction Fuzzy Hash: 17A1B6746D8204BFF6157BF1DF46F2D36259FA5B0CF208168EA006E1F2C9B279219662

Uniqueness

Uniqueness Score: -1.00%

Function 00C305C4 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcA.USER32(?,00000000,?,?,FFFFFFFF), ref: 00C310A3

Memory Dump Source

Source File: 00000000.00000002.1995181409.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_Eaton PO-45150292964.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 8c7899244b04bf77df66a88ccebab00dd5d2a200458d119c5d7527e5f289206e
Instruction ID: cefee35d192f497cebbc512c725c435c94329c4a6d309232f693f385f1a95b53
Opcode Fuzzy Hash: 8c7899244b04bf77df66a88ccebab00dd5d2a200458d119c5d7527e5f289206e
Instruction Fuzzy Hash: 841116B5810289DFCB24DF9AD884BDEBFF4FB88310F148459E919A7210C375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C31030 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcA.USER32(?,00000000,?,?,FFFFFFFF), ref: 00C310A3

Memory Dump Source

Source File: 00000000.00000002.1995181409.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_Eaton PO-45150292964.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: a5cb6d5c4a9c1e019323734e412dff3d2f3e81af88573533aa894a2d8ba9bfba
Instruction ID: 1ca95447378443c2b19284784f7b5d1355f5a5440d5d11661b6f3d13598f19cc
Opcode Fuzzy Hash: a5cb6d5c4a9c1e019323734e412dff3d2f3e81af88573533aa894a2d8ba9bfba
Instruction Fuzzy Hash: 971113B6910249DFCB10CF99D984BDEBFF4FB88310F248419E929A7210C375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C30D29 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 00C30D98

Memory Dump Source

Source File: 00000000.00000002.1995181409.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_Eaton PO-45150292964.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5845b760a5c4fa9e4b9f58422984ecfb4cbe08ccf990d5ef0683385d7f573c6b
Instruction ID: 26fbf58525cfa49c52360da1b3dd8472941ca57e12701ec37cb266ec3334c373
Opcode Fuzzy Hash: 5845b760a5c4fa9e4b9f58422984ecfb4cbe08ccf990d5ef0683385d7f573c6b
Instruction Fuzzy Hash: 381102B68002499FCB10CF9AD984BDEBFF4FB88310F208459E459A7250C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C30D30 Relevance: 1.3, APIs: 1, Instructions: 47
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 00C30D98

Memory Dump Source

Source File: 00000000.00000002.1995181409.0000000000C30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c30000_Eaton PO-45150292964.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c6841d22fb525f6c402dd07609cfd3378ed333a6a603e1e91b393812f040eff9
Instruction ID: 03607ecdaf7a81f76ae4a4f5d747eae70b102de8969a366378a4f48a6096b311
Opcode Fuzzy Hash: c6841d22fb525f6c402dd07609cfd3378ed333a6a603e1e91b393812f040eff9
Instruction Fuzzy Hash: 9111F5B6C002499FCB10DF9AD545BDEBFF4EB88310F208419E559A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A50420 Relevance: 1.3, APIs: 1, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040,?,91AFCA54,00000000,04A50083,0000003C,0000001E,0000004A,0000003E,00000042), ref: 04A5043F

Memory Dump Source

Source File: 00000000.00000002.1996028333.0000000004A50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a50000_Eaton PO-45150292964.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 06eb02c548db0a05d1e20e56bead04f6bc1efedc2ff2b69c3f0a506310807bbb
Instruction ID: 51193051b077660b080e775acc6d7b0aa95179f2b6e878ce1320efcbcba43ad8
Opcode Fuzzy Hash: 06eb02c548db0a05d1e20e56bead04f6bc1efedc2ff2b69c3f0a506310807bbb
Instruction Fuzzy Hash: 3CD022701CC3007AF2017BB14F02F1C36A0AF50B0DF400814FB04380F2C5BAB8180256

Uniqueness

Uniqueness Score: -1.00%

Function 0099D6CD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1994757325.000000000099D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0099D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99d000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a7987bbe15a41ec5af68b7e8c7e533812b3109ac67951bf926c2b535e673ab
Instruction ID: d375779a8808d8aeb4fbc253a6c119ddbe691ea93bfb24db130b85b7651639e8
Opcode Fuzzy Hash: e2a7987bbe15a41ec5af68b7e8c7e533812b3109ac67951bf926c2b535e673ab
Instruction Fuzzy Hash: 9301D6B10063409AEF109A5EDDC4B67FFECEF55360F28C91AED090A286C3789845CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0099D6CC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1994757325.000000000099D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0099D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_99d000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6211a2e78ee8e760672a181f9601b986044573cfe8164250a4857e759b729ea2
Instruction ID: 8ae7cdce661a825678e5139c6a0d54da946dbd22121884a62fd6eeee2d6e73c8
Opcode Fuzzy Hash: 6211a2e78ee8e760672a181f9601b986044573cfe8164250a4857e759b729ea2
Instruction Fuzzy Hash: 4FF0CDB1405340AEEB108A0ADDC8B62FFACEF51364F18C45AED080B286C3789845CAB0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Eaton PO-45150292964.exePID: 4512, Parent PID: 6620COMMON

Execution Graph

Execution Coverage:	12.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	26
Total number of Limit Nodes:	5

Executed Functions

Function 06681030 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 06681712
$]q, xrefs: 06681753
$]q, xrefs: 0668175F
$]q, xrefs: 0668172F
$]q, xrefs: 06681706
$]q, xrefs: 0668173B

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-3723351465
Opcode ID: a62e65e29a60859aafb19e70d9e36fba2cf2470d69b49e4c2906f5bf6dd0e33e
Instruction ID: 78365a8ff29cd30c19082ff100adb61072f82bab59efa789379f1adfaa9d702b
Opcode Fuzzy Hash: a62e65e29a60859aafb19e70d9e36fba2cf2470d69b49e4c2906f5bf6dd0e33e
Instruction Fuzzy Hash: C3322E31E1071A8FCB55EF75C89459DF7B2FFC9300F24866AD409A7254EB30AA86CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06685D30 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$]q, xrefs: 0668629C
$]q, xrefs: 066862A8

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: $]q$$]q
API String ID: 0-127220927
Opcode ID: 5869241172f2a5edb506773abca9ed08cd51257265b049b5d35024c175358218
Instruction ID: 790ccf0514fe318fc94281d34fa77f15d7ff2cff58192340cb6448b44071ceab
Opcode Fuzzy Hash: 5869241172f2a5edb506773abca9ed08cd51257265b049b5d35024c175358218
Instruction Fuzzy Hash: 91028F30B002059FDB54EB78D594A6EB7E2FF84304F258669E806DB395DB35EC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0668E0B9 Relevance: 2.8, Strings: 2, Instructions: 337
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Xaq, xrefs: 0668E1CF
$]q, xrefs: 0668E1B6

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: Xaq$$]q
API String ID: 0-1280934391
Opcode ID: f5813452347c84e16d36efe564d08da79ba26844e8864600a3546703175ef87f
Instruction ID: 9d879720024b6ecf9881b9de92df04c0d0463f2464212c6e26da98df398ecab2
Opcode Fuzzy Hash: f5813452347c84e16d36efe564d08da79ba26844e8864600a3546703175ef87f
Instruction Fuzzy Hash: 36B1C230B042189FDB58EF79985467E7BB7BFC8710B19852EE50AD7384DE398C029792

Uniqueness

Uniqueness Score: -1.00%

Function 00FDADF0 Relevance: 2.7, Instructions: 2707COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d88b86519291a34cdc270c28efd42be7176b303712b090fe1dbb86f8d0a66d72
Instruction ID: 573004f0b6d32fbf79167846143151ce514e5e58c57bd6939e8db51764cd0e87
Opcode Fuzzy Hash: d88b86519291a34cdc270c28efd42be7176b303712b090fe1dbb86f8d0a66d72
Instruction Fuzzy Hash: B553E831C10B1A8ACB51EF68C8905A9F7B1FF99310F15D79AE45877221FB70AAD4CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FD3E80 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vl, xrefs: 00FD40CB

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: b3edf202817325be9231ff04afc15c1ada6478f3105550a0ac82c994b5161b93
Instruction ID: db13116ea186ccd369fbb96c1a35374e5311f9c769e61f4ff2ec8609af178698
Opcode Fuzzy Hash: b3edf202817325be9231ff04afc15c1ada6478f3105550a0ac82c994b5161b93
Instruction Fuzzy Hash: 77915E71E00209DFDF14CFA9C9857DDBBF2AF88314F18812AE415A7354EB749986DB82

Uniqueness

Uniqueness Score: -1.00%

Function 06680328 Relevance: 1.0, Instructions: 1004COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63fbd3d990954d5555b74c6d965c38894d49d1e41598cbb714033bceeeb6fc3
Instruction ID: 6b3ccb599e442dd7462ee5989b14587ac52dc17d2776e9d6f77b567eb8cf6b90
Opcode Fuzzy Hash: f63fbd3d990954d5555b74c6d965c38894d49d1e41598cbb714033bceeeb6fc3
Instruction Fuzzy Hash: 11925734A00204CFDB64EB68C584A5DB7F2FB85314F55CAA9E449EB351DB35EC8ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 066845A0 Relevance: .8, Instructions: 812COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 639b05cb11daf2a5ccd705da5d01b005f14b946d958dbdcbd8e738b5743b7d5d
Instruction ID: 31c8d2fa3508ffcc5381601725312440ac0a4af238b90a3e12c1e164dd1c611d
Opcode Fuzzy Hash: 639b05cb11daf2a5ccd705da5d01b005f14b946d958dbdcbd8e738b5743b7d5d
Instruction Fuzzy Hash: B4629D30A002068FDB54EB78D584BADB7F2EF84314F258629E506EB395DB35ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0668A140 Relevance: .6, Instructions: 636COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a27e339d734e6efbaffa69935985030183e6e40946b1d338c5522b04dfc927
Instruction ID: 527ca18738cb5c9712e45c561d79df6725da10eecbb9fbaa680259ba999185ce
Opcode Fuzzy Hash: 14a27e339d734e6efbaffa69935985030183e6e40946b1d338c5522b04dfc927
Instruction Fuzzy Hash: E8327F34B102099FDF54EBA8D894BADB7B2FB88310F218626E905D7355DB35EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06683578 Relevance: .6, Instructions: 588COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcaad5a79b8639913bcf3b20da845ea284a5bb55904855f1decad1defff4844b
Instruction ID: 35ce4e0e5235447ba6710e621a65308ba75bce9f5337172bd82df2f5a7a63aea
Opcode Fuzzy Hash: bcaad5a79b8639913bcf3b20da845ea284a5bb55904855f1decad1defff4844b
Instruction Fuzzy Hash: E422E171F002159FDB64EFB8C8806AEB7B2EB84710F248569D919EB345DB34ED42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 066891E0 Relevance: .6, Instructions: 576COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14ccdfad3b658c994bb35c8db38f53a95726a98fd15f80620f237ee3846e0ad0
Instruction ID: cb931a29fa294bd11fafd3eb7a035ef4b4792cbcbc66f27ab7c85409bb8807b5
Opcode Fuzzy Hash: 14ccdfad3b658c994bb35c8db38f53a95726a98fd15f80620f237ee3846e0ad0
Instruction Fuzzy Hash: 71225170E102099FDF64EA6CD4907BEB7A6EB85310F248B26E459DB391CA35DC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD4A98 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e788d95f9468e0db2569877b3a649c577570c3b1983ad3bb2f236584dafbd71
Instruction ID: 526d361ee814be9e87d9601ee3c89ee7558785d6d6707c9f5c283e9cf5ac9cf5
Opcode Fuzzy Hash: 5e788d95f9468e0db2569877b3a649c577570c3b1983ad3bb2f236584dafbd71
Instruction Fuzzy Hash: 64B13E71E102099FDF10CFA9C98579DBBF3AF88314F18852AD819E7394EB74A845DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FD4810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 00FD487F
\Vl, xrefs: 00FD49D2

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: 5ec53226368e63a72a08ff921f8245495cbd5f40936654ad298cff4bcec96371
Instruction ID: a1744a9518bc7dd4e572ef5f71fbfcfff893422b0d0def2026cced3cd74858ce
Opcode Fuzzy Hash: 5ec53226368e63a72a08ff921f8245495cbd5f40936654ad298cff4bcec96371
Instruction Fuzzy Hash: A6718F70E002498FDF10CFA9C88579EBBF2BF88314F18812AE419A7354DB74A842DB85

Uniqueness

Uniqueness Score: -1.00%

Function 00FD4806 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Vl, xrefs: 00FD487F
\Vl, xrefs: 00FD49D2

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: \Vl$\Vl
API String ID: 0-415357090
Opcode ID: 96f0dae882e274d8514525ca763ed0e88b76fa3088ef695b332eaf84c8193d17
Instruction ID: 54181b098f61452ee2c4837bd024ec92c7393d68db0f7b2896c2b24f00da1d80
Opcode Fuzzy Hash: 96f0dae882e274d8514525ca763ed0e88b76fa3088ef695b332eaf84c8193d17
Instruction Fuzzy Hash: 35715E71E002499FDF10CFA9C98579EBBF2BF48314F18812AE419A7354D774A842DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0668E950 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 994d1bef124865de4a87c808abb87ef46736b601aac7ddcd667f274b6f737eb8
Instruction ID: 3c7aeb5353d13452873ca7b47c0238a8b4dadbd511078951eceb844a099060fa
Opcode Fuzzy Hash: 994d1bef124865de4a87c808abb87ef46736b601aac7ddcd667f274b6f737eb8
Instruction Fuzzy Hash: FF412472D043499FCB14EFB9D80469EBBF6EF89310F05866AD908A7341EB749845CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0668EA38 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNELBASE ref: 0668EA9F

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 2ae6db5286120eba959729dbcf1a583b52602c52b91271e407497e3d6f57d084
Instruction ID: f7ceb00e2a7f142631e6463a65bc64a5a13911efdf58b87dd358b3493bf565aa
Opcode Fuzzy Hash: 2ae6db5286120eba959729dbcf1a583b52602c52b91271e407497e3d6f57d084
Instruction Fuzzy Hash: 1A111FB1C0025A9FCB10DFAAC444B9EFBF4BB48320F11812AD818B7240D378A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD3E74 Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

\Vl, xrefs: 00FD40CB

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: 9780a150cbe75a7eeda33cbd355b1d0ee7e4772b988bb8f76fc2577553603ceb
Instruction ID: 3b6203e2b5ecc9f53122585c8a73b8e97460d426d20bb80aef867e03e2929bcc
Opcode Fuzzy Hash: 9780a150cbe75a7eeda33cbd355b1d0ee7e4772b988bb8f76fc2577553603ceb
Instruction Fuzzy Hash: 14A17F71E00209DFDF15CFA8C9857DDBBF2AF88314F18812AE419A7354DB749986DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6ECF Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00FD6F06

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: c83ecbedebedb592e554c898d2435de8ee30fabfbe79323cc09befa98feeb056
Instruction ID: a8b0d22684e3883a9575e14eb6ce803f9fa971ae952504d56da7eae95c6df4d5
Opcode Fuzzy Hash: c83ecbedebedb592e554c898d2435de8ee30fabfbe79323cc09befa98feeb056
Instruction Fuzzy Hash: D9515A34B142148FCB14EB68C458AAE7BF2FF89710F2544AAE406DB3A1DB75DC41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD7D90 Relevance: 1.3, Strings: 1, Instructions: 95COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00FD7DAB

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 8dc13f2e970fdddf5a644c26e76b16b4aaabd5034598d37374addad8a2c7b9f5
Instruction ID: 44beb59911b711fff847d11d47d7384e2401cec802b49979b6afdf7d073b35c2
Opcode Fuzzy Hash: 8dc13f2e970fdddf5a644c26e76b16b4aaabd5034598d37374addad8a2c7b9f5
Instruction Fuzzy Hash: 31315C31E143199BDB24EF65D4447AEB7B2EF89310F24852AE805EB340EB70AD429B51

Uniqueness

Uniqueness Score: -1.00%

Function 00FD7D80 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00FD7DAB

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: d8b1d8d84376ab4a43f1071007083b08614bbbaf471ef9389cad674e982743eb
Instruction ID: e1a753f6c3d9093bdab05a31a3a53700b67bb0ebbbc7cdc0e04ef07c56024e35
Opcode Fuzzy Hash: d8b1d8d84376ab4a43f1071007083b08614bbbaf471ef9389cad674e982743eb
Instruction Fuzzy Hash: 6F315A30E1435A9FEB25EF65C4447AEB7B2EF85310F28846AE805EB340EB709C429B51

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6B98 Relevance: 1.3, Strings: 1, Instructions: 75COMMON

Download Yara Rule

Strings

LR]q, xrefs: 00FD6BCF

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: LR]q
API String ID: 0-3081347316
Opcode ID: 712d9f50434ff60ba2247eb7785bb22371c628e236adc860b2a21c2bd661a476
Instruction ID: bfbb6792665b9f8c62a55469bbdf0dafdac95a6f47221c1d5c2263df0d7d55e9
Opcode Fuzzy Hash: 712d9f50434ff60ba2247eb7785bb22371c628e236adc860b2a21c2bd661a476
Instruction Fuzzy Hash: B4213B317082405FC716AB3CD4652AE7BF2EF86310B06849FD055CB39ADE359C46C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8720 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4277489ea815b731826bd920c3ace9c5a66a70aacc5e868dca876cee9875d1a
Instruction ID: f5dd11319d66032bd0414ef91082efa6095dbcc0a4da7fbe276bceae84941de8
Opcode Fuzzy Hash: c4277489ea815b731826bd920c3ace9c5a66a70aacc5e868dca876cee9875d1a
Instruction Fuzzy Hash: 931282707012069BCB65AB3CE59866D33A3FBC5350F26492AE406CB355CF35EC879BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA1AA Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d01203a4367e38dc69d74c1b690afc2e343b6ae38e8e3098ed6dcd9dac0727
Instruction ID: b0be88890b1057cb41792bcc88027111e9ac51a8f66f34e7d3c5fe2a2d1939a2
Opcode Fuzzy Hash: 86d01203a4367e38dc69d74c1b690afc2e343b6ae38e8e3098ed6dcd9dac0727
Instruction Fuzzy Hash: F8E1CF30B002058FCB14DB68D594BADB7B3FB89320F288466E509DB395DB35DD42DB56

Uniqueness

Uniqueness Score: -1.00%

Function 00FD4A8E Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d97c0e2f33fe55551cfef4d8b1797d97b305950c00f2cb8158217dcd0608e74e
Instruction ID: fdd5120575d43f60f7e62eb01b706f5f1170521696d1b71c2266624cdb5e051d
Opcode Fuzzy Hash: d97c0e2f33fe55551cfef4d8b1797d97b305950c00f2cb8158217dcd0608e74e
Instruction Fuzzy Hash: A1A13E71E102098FDF10CFA8D9867DDBBF2AF88314F18852AD819E7354EB74A845DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA6C8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7851afbffb89aa4a38eb68442207e6d781c49d75fef996f209b42f7898ce1bb2
Instruction ID: bba3713b122ce25f7ceab2b3f424da9d5ebf8edab36c0d10564c56440bb985db
Opcode Fuzzy Hash: 7851afbffb89aa4a38eb68442207e6d781c49d75fef996f209b42f7898ce1bb2
Instruction Fuzzy Hash: C0514D71A00205DFDB14DF69E884799FBB6FF88320F24C1AAE9089B355E770D945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6CD4 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b03bd9d4c5dfec717e379c6f54011acf31dc3fb6e4d852ef937deb492d11bcbd
Instruction ID: 7735e41d448fb2f2c0b26fe7a7a5b529e27bf7b9450123e259f052ac221e4502
Opcode Fuzzy Hash: b03bd9d4c5dfec717e379c6f54011acf31dc3fb6e4d852ef937deb492d11bcbd
Instruction Fuzzy Hash: 17513374E002188FDB14CFA9D885B9DBBB2BF48314F18852AE819BB391C774A845DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6CE0 Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a076dc103e8433dd40db205b391260db9803029ad8e437a52be464ebd7933ba7
Instruction ID: 3ba4edd6e67dc990401ba2cc921512566622e42890c71f7dddd636e786d5b4ae
Opcode Fuzzy Hash: a076dc103e8433dd40db205b391260db9803029ad8e437a52be464ebd7933ba7
Instruction Fuzzy Hash: B7512474E002188FDB14CFA9D885B9DBBB2BF48314F18852AE819BB391D774A844DF95

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1128 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0129369a6991c0f872e550b8f74564da83029bd45086d6fd0bc19f0d2976851b
Instruction ID: 28fddd3cb9ffa482932b7c23f4f3e3745d3a7c200e9ba2a69e4f4aefd6c8f355
Opcode Fuzzy Hash: 0129369a6991c0f872e550b8f74564da83029bd45086d6fd0bc19f0d2976851b
Instruction Fuzzy Hash: 12511E7411218AAFCB06FB28F888B553F76F76E3043164957E484DB22AD7246D45EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1138 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591f04f5b2b869a057b5bd502123f4cbeb5fe8aa4c6e7c594768634497c6a581
Instruction ID: 5b964ec2d099624e17452819db5094bdde032529294bb40b22202b16f2873b3b
Opcode Fuzzy Hash: 591f04f5b2b869a057b5bd502123f4cbeb5fe8aa4c6e7c594768634497c6a581
Instruction Fuzzy Hash: A6513F7421218AEFCB05FB28F888B553F6AF76E3043164956E484D7229DB306D45EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FDDE6A Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb823537048e829c46a313e37ab61e46fa79fc5ad428d8c68b80185fda96f68
Instruction ID: 461cf2e8cba6e704e450bb57c68bde661760741e4d7cb255a644192e9f374a15
Opcode Fuzzy Hash: bbb823537048e829c46a313e37ab61e46fa79fc5ad428d8c68b80185fda96f68
Instruction Fuzzy Hash: 813149B5B00216AFD705DB28C890E3AB7ABFB88304F15C169E5058B299CB32EC53D791

Uniqueness

Uniqueness Score: -1.00%

Function 00FD26DC Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d152f0a51c3046dbe098fc2ecbeb469c04915abaf81014bc60222770cffc1ac0
Instruction ID: 6d03fb17bcb3648a4da04cc3687804482928ec2045008785cab7eea176d7cd36
Opcode Fuzzy Hash: d152f0a51c3046dbe098fc2ecbeb469c04915abaf81014bc60222770cffc1ac0
Instruction Fuzzy Hash: 2141F2B0D003499FDB10CFA9C584ADEBFB6FF48314F24842AE409AB250DB759946DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD26E8 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff65d5886c2413bc6051d7d0efac1d607c879bb2f7ea7c14a57e3ae03fe4ca3b
Instruction ID: befa3b132c3006502a25b56a86a9917465927626e4088bb77d56a94471c7bf25
Opcode Fuzzy Hash: ff65d5886c2413bc6051d7d0efac1d607c879bb2f7ea7c14a57e3ae03fe4ca3b
Instruction Fuzzy Hash: 9F410EB0D003489FDB10CFA9C484ADEBFF5FF48314F24842AE809AB250DB75A946DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD50A8 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 170e10126b745603c01771757ab3e11e58938f6acae8fc1ce2f52ed6f97df4bf
Instruction ID: 05fba1ed88b6d8b6a30418c2873f057bd5c4226d713ac5249849edd888aceea4
Opcode Fuzzy Hash: 170e10126b745603c01771757ab3e11e58938f6acae8fc1ce2f52ed6f97df4bf
Instruction Fuzzy Hash: 45316730B006099FDB14EB74C9157AE77B6BF88740F24046AD401EB3A8DB36DC45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD5097 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ac61b1f43bdc497e55767a321ba4f973a6bb6245942c84357c8a9c2cacf1e9
Instruction ID: a23a21410b194e61ca48f253a28bda6ca3fe5d7bb1a72ea6fedc1b03cbef366c
Opcode Fuzzy Hash: f2ac61b1f43bdc497e55767a321ba4f973a6bb6245942c84357c8a9c2cacf1e9
Instruction Fuzzy Hash: 7531CA30A006099FDB14EB74C9687AE77B3BF88740F2404AAD401EB3A8DB36CC45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA068 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63e20fc38d0faaf8f018e885fd9d1a18ecff49ca6b572be7267978612324cb46
Instruction ID: 317ec63a40beb4c0250181901e77120489a17ced80a288762c692d080b9bc90a
Opcode Fuzzy Hash: 63e20fc38d0faaf8f018e885fd9d1a18ecff49ca6b572be7267978612324cb46
Instruction Fuzzy Hash: 97316D31E0424A9BCB19CF64C45469EF7B2FF89310F14861AE905AB341DB719D46CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD169F Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a17b56652b7cb2ec7c1ca39d843e50187f8052edfbb68495b9cb05ef58b27d
Instruction ID: 726f08e3d6dc6fad623adea61ba5bcab8435840a39eed6ac57311da184ad38a0
Opcode Fuzzy Hash: 01a17b56652b7cb2ec7c1ca39d843e50187f8052edfbb68495b9cb05ef58b27d
Instruction Fuzzy Hash: 5721D878A00141ABDF22F778E8887193767F759314F294A67E405C7369DB38DC41D792

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA078 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2499afd2aee56bb7b8bb08a705d83df1ba173aaf5ca7fbf01a6e1c112199e304
Instruction ID: 249f3cdea5840b0510857397b9c916e7620771e1fefc653fd1f1577f72f42920
Opcode Fuzzy Hash: 2499afd2aee56bb7b8bb08a705d83df1ba173aaf5ca7fbf01a6e1c112199e304
Instruction Fuzzy Hash: B2214D31E0424A9BCB19CF68D85469EB7B3FF89310F14C61AE905EB344DB719D82CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD17C0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73c76da3ff68b63076a740946c9a17a0159e50a4b95bf214f4be44992a2220b0
Instruction ID: 8dc066db50f80d2929115c9f39463ed39059573afd51786d15b4bb75e921fdea
Opcode Fuzzy Hash: 73c76da3ff68b63076a740946c9a17a0159e50a4b95bf214f4be44992a2220b0
Instruction Fuzzy Hash: B121F635F002416BCB21AB79E84876E7BA7FB89321F140977E809D7304EB35CC429B81

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1488 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e756fb2b459a33e55d3cb8379f0d6905b77804970d173899ae693e91c0543118
Instruction ID: b3a66428c834c2d7789a712523ccd7ea1c339fa3ba8f2251b4d1001e0bad59e7
Opcode Fuzzy Hash: e756fb2b459a33e55d3cb8379f0d6905b77804970d173899ae693e91c0543118
Instruction Fuzzy Hash: 37219271E002119BCF21EBB899413AD77A2FB46320F29047BE806EB341EB39CD419791

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA85A Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4bbbcfb4648c717051d04c47f7e0327cad7ac95bb23ef80d11347872fa7755
Instruction ID: 162f986b2a66dd93d3c341583281ac583f6de72cddb2f511f23942f9cca0b814
Opcode Fuzzy Hash: fe4bbbcfb4648c717051d04c47f7e0327cad7ac95bb23ef80d11347872fa7755
Instruction Fuzzy Hash: DE21B071B001048FEB14DF78C864BAD7BF6AF8C720F298166E505EB3A4DA71CD019B56

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9F68 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90be4f2e28d2488ddab8326434b625ebffe112b18857dde914112eb67cbe237d
Instruction ID: 466d884fb9c553fcee4ea45aeaef78c1bacee72c6e60449cf92797d5b268cb0e
Opcode Fuzzy Hash: 90be4f2e28d2488ddab8326434b625ebffe112b18857dde914112eb67cbe237d
Instruction Fuzzy Hash: 30216231E046099BCB15CFA4C85469EB7B3EF89310F28851AE815FB750DBB0A946DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD4F8A Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90cb4333bb7609270870e8abcb669b59020234170b3ee5b75efabb232526586b
Instruction ID: 8542a524d4067e6d999f3d1b3de4158747ddc96356c0aa5afb7ea61b8a190282
Opcode Fuzzy Hash: 90cb4333bb7609270870e8abcb669b59020234170b3ee5b75efabb232526586b
Instruction Fuzzy Hash: D6215C34A00609CFCB14EB78C959BAD7BF2FF49711B1444A9E406EB3A4DB319D01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1382 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777c0c169af388553772be480d3d31cc39354c7b3eef9ff1a1c270cd2369290b
Instruction ID: 769c15c03ec1fe4408cd086f8cb3866c3ca1d780ada41a8430d5370bfd783684
Opcode Fuzzy Hash: 777c0c169af388553772be480d3d31cc39354c7b3eef9ff1a1c270cd2369290b
Instruction Fuzzy Hash: 6421A574A042419FDB31A778E48833D3B62FB17325F59086BE806C7795DB358C86D752

Uniqueness

Uniqueness Score: -1.00%

Function 00F4D005 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450233884.0000000000F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f4d000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea27d44feeb3ed4fa54ba9bf8cd6e332d5e1009c5b5809ff6a355b176c234a04
Instruction ID: 52db5e7068ce800b113b0363373d01f4e8a4b1e045a106b510fd55efa220bb8d
Opcode Fuzzy Hash: ea27d44feeb3ed4fa54ba9bf8cd6e332d5e1009c5b5809ff6a355b176c234a04
Instruction Fuzzy Hash: 36215E7150D3C09FC703CB24D994711BF71AB46224F29C5EBD8898F2A7C23A981ADB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F4D030 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450233884.0000000000F4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f4d000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a99886d55684687dfecc714a29721a9681d6cfeaf0f05af21858f06386b5c2f6
Instruction ID: a5b6eed3e6932895fb8010a121bf533ca2fe9128e842b78a9db86ba0af9a62ae
Opcode Fuzzy Hash: a99886d55684687dfecc714a29721a9681d6cfeaf0f05af21858f06386b5c2f6
Instruction Fuzzy Hash: A821F5B1904244DFDB14DF18D9C0B26BFA5EB84324F34C56DDD0A4B25AC376D847DA62

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1888 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94d16807bcf38d84bf9175bbf0cd3d6edc8149209ad9c4c6affc7dc89e0fa87c
Instruction ID: bc7cc47955c2304c855f67b876d1425cfdc56e0f262bde6b860b78e14e8d591c
Opcode Fuzzy Hash: 94d16807bcf38d84bf9175bbf0cd3d6edc8149209ad9c4c6affc7dc89e0fa87c
Instruction Fuzzy Hash: D6213D31B002099FDB14EB78C9257AE77F6BB49351F24046AD405EB394DB35CD40EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9F78 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba524eb3b87b2d0f922ac0955fe51dbc0e2a6f24a9d9951d3fdd36931713fe7
Instruction ID: 07dd05a41ddb199aba38f8165e866009f8e2dbd75f8bcb8d0037c6ce29e7e581
Opcode Fuzzy Hash: 4ba524eb3b87b2d0f922ac0955fe51dbc0e2a6f24a9d9951d3fdd36931713fe7
Instruction Fuzzy Hash: 1E213031E046099BCB19CFA4C45469EF7B6EF89310F24C51AE815FB390DBB0AD46DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD16B0 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 031f937d8d5aee3f20ae80f3776139b0b6f51dc438ab5e07d85d3a8a8f94c4b4
Instruction ID: 60aa625b56bbb9f8e2d6f7c59622c09a2aa40a37ebef36ef275df4f0ecfd89ca
Opcode Fuzzy Hash: 031f937d8d5aee3f20ae80f3776139b0b6f51dc438ab5e07d85d3a8a8f94c4b4
Instruction Fuzzy Hash: 4C216078A001416BDF22F768E88871A3767F749314F254A27E40AC7369DB78DC818B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1878 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9760863f173e1cf59cda625ca0e8ddb9cd12d7004015fca5bae0a9187ba86921
Instruction ID: 7e8f2e1bce882ede257bd709dab6212e710aa27eee205eec546ab50af87152c5
Opcode Fuzzy Hash: 9760863f173e1cf59cda625ca0e8ddb9cd12d7004015fca5bae0a9187ba86921
Instruction Fuzzy Hash: C3215E31B002059FDB14EB74C9697AE77B2BB49345F28046AD005EB3A5DB35CD44EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD4F98 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2fc9f5577e23cd7772d51defd87a54af9f83cc572097b55fe0505dbc61171f3
Instruction ID: 1ed3fc127f12b0455abba48a3f5f1d7fd02fc4a9e3e8a77aefd57a1bc8f31055
Opcode Fuzzy Hash: e2fc9f5577e23cd7772d51defd87a54af9f83cc572097b55fe0505dbc61171f3
Instruction Fuzzy Hash: C5214A34B00209CFCB14EB78C958BAD77F2BB4D711B104469E506EB3A4DB329D00EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FD0848 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb83bf78570a2d251c5d58f4284c22e6784449c6661ad5c201498f4f68978a7
Instruction ID: 3758529f264b77132728d3517c41c5288e34c98e014aa7cf77547d82be656c09
Opcode Fuzzy Hash: ecb83bf78570a2d251c5d58f4284c22e6784449c6661ad5c201498f4f68978a7
Instruction Fuzzy Hash: 3C118F35F002044BDF64AA78C44832D3292EB45760F28493BE006CB391DE75CC85BBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD0838 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 370701bcd2d20a2cc043071dd2157c16831915c34770937eec65835043e7fe78
Instruction ID: ba0a280faef6534d54874538b3a58ecf450fd596dff9112bb180390e7b2bfa1e
Opcode Fuzzy Hash: 370701bcd2d20a2cc043071dd2157c16831915c34770937eec65835043e7fe78
Instruction Fuzzy Hash: 9911A335E043444FEF21AA74985837D7792EB56360F28497BD406CB382DE65CC85BBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00FDDBCF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e7c4a3dfe22abb7aed903978cc8abacfae3d5bb199c5d8d920c62c82ed8aa6
Instruction ID: fc37a1dd7a8852e984ad3cb812b079cc7ebb8b898b9e95476a398ed114f34eff
Opcode Fuzzy Hash: 83e7c4a3dfe22abb7aed903978cc8abacfae3d5bb199c5d8d920c62c82ed8aa6
Instruction Fuzzy Hash: 3501F172B00229ABD7249A99E84576BBB6AFBC4730F258517E2184B208DFB06C05C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1498 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59d5a2ed03ce10ae4b0993a3ba3f33e42a1ff2c5a9e655f970eef600e4384ea0
Instruction ID: 13fa5d7d2801383f200234900206409df87e9fb0df3a4d714c275346ff204eba
Opcode Fuzzy Hash: 59d5a2ed03ce10ae4b0993a3ba3f33e42a1ff2c5a9e655f970eef600e4384ea0
Instruction Fuzzy Hash: 9C016131E002149FCB21EFB8985129D77E7FB49320F28047AE805E7301EB39D8419B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA6B8 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c56c87aedfff07dadc143c3649ae8ebc7d22966acd17eb4a7a1fa8edc767236a
Instruction ID: 7b94fd9c02b2429cee24dc0e5faf0bd2f1aad7746b829851285ff29297425985
Opcode Fuzzy Hash: c56c87aedfff07dadc143c3649ae8ebc7d22966acd17eb4a7a1fa8edc767236a
Instruction Fuzzy Hash: C011E530A002048BCB05DFA4D89069ABFB2EF85310F29C5A5DC4C5F29AD774DD56CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8F08 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d10ac124195ba78cb2d9f255513a1d4c4afca5d0e36ba34b167c589b92bbb4
Instruction ID: 098e73154982c0d8383e818d27b1f5654baf35cf3410ddc5dd09b3e4504be534
Opcode Fuzzy Hash: 57d10ac124195ba78cb2d9f255513a1d4c4afca5d0e36ba34b167c589b92bbb4
Instruction Fuzzy Hash: BF01D474910189DFCB42FBB8E85479C7BB2EF45300F2145AAD008DF255DA305F568B61

Uniqueness

Uniqueness Score: -1.00%

Function 00FD1524 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8b6e94d1d4decac742e2c17e2d98d4b125d22545bc1d9faedba12154b731662
Instruction ID: a6e67f46af964e1eb3439756d9ee0393f9428bb5063ae9cdbbb2b61ea02e1a7a
Opcode Fuzzy Hash: b8b6e94d1d4decac742e2c17e2d98d4b125d22545bc1d9faedba12154b731662
Instruction Fuzzy Hash: 1FF0F637E04150AFD7228BA4A8913AC7BA3FE9632172C00D7D802DB352D739D842E751

Uniqueness

Uniqueness Score: -1.00%

Function 00FD7EA8 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad18d15887186570dc43cbb41e7c34001e5559a0ba2673e5eb615a8071b5bdbc
Instruction ID: 73af3a5c65b005e7c9ff8609c62d92f700d049dd5b9d827a3871b5381c4c8b2c
Opcode Fuzzy Hash: ad18d15887186570dc43cbb41e7c34001e5559a0ba2673e5eb615a8071b5bdbc
Instruction Fuzzy Hash: 4EF0C435B40218CFC714EB75E598B6C77B2EF88215F1544A8E506DB3A4DB35AD02CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8F18 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 977369bef906995fef603391963ce566a4149a1e93e4141140bc5959aedef1d7
Instruction ID: 5abee8e9c3835e7922cd592e01996ebb1e2f17d456e84b181ebd521fbf68e1bb
Opcode Fuzzy Hash: 977369bef906995fef603391963ce566a4149a1e93e4141140bc5959aedef1d7
Instruction Fuzzy Hash: 2BF0317491010DEFCB41FFB8F844A9D7BB6EB44304F214A6AD409DB294DF316E558B91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 06685650 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$]q, xrefs: 06685BA8
$]q, xrefs: 0668577D
$]q, xrefs: 06685740
$]q, xrefs: 06685BB2
$]q, xrefs: 0668574C
$]q, xrefs: 06685BBE
$]q, xrefs: 06685B09
$]q, xrefs: 06685AFD
$]q, xrefs: 06685771
$]q, xrefs: 06685B9C

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: $]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q$$]q
API String ID: 0-2843079600
Opcode ID: 0e9c8c12bedee3b28773fbe3d9dcc61e9b5fb641ebdd3e1aef60b2c02f5ba705
Instruction ID: 0baad35f459878bd3ff565151d819a694cac95d0c98b0a28e6e37922909f7124
Opcode Fuzzy Hash: 0e9c8c12bedee3b28773fbe3d9dcc61e9b5fb641ebdd3e1aef60b2c02f5ba705
Instruction Fuzzy Hash: 82120E70A01219CFDBA4EF79C894A9DB7F2BF88304F248669D40AAB355DB349D45CF41

Uniqueness

Uniqueness Score: -1.00%

Function 06683C8F Relevance: 2.9, Strings: 2, Instructions: 417COMMON

Download Yara Rule

Strings

\Obq, xrefs: 06683DAA
XPbq, xrefs: 06683F56

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: XPbq$\Obq
API String ID: 0-409418754
Opcode ID: 1fcd8454b4b7e2db101d165b5db519bb96168987e19b8108fec6e47a4a0ba027
Instruction ID: 1154d8212e3868e01c6d9a612fa40fbddefc196e0baefa353d1454ddb604e2cb
Opcode Fuzzy Hash: 1fcd8454b4b7e2db101d165b5db519bb96168987e19b8108fec6e47a4a0ba027
Instruction Fuzzy Hash: E6E11531B101148FCB54EBB8D494AAEBBF6FF88710F25856AE546EB391CA71DC41C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00FD41C8 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\Vl, xrefs: 00FD447F

Memory Dump Source

Source File: 00000006.00000002.4450426874.0000000000FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_fd0000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID: \Vl
API String ID: 0-682378881
Opcode ID: df65cfa6ec61d49a4a8ae191cee3c92f7c65fe16e8f97b7d56e0a8a95210ba94
Instruction ID: 0bd2a10035e260d0c60a5eac6851cfd0a40f90c0aa15bb92625cf9df7177fdb2
Opcode Fuzzy Hash: df65cfa6ec61d49a4a8ae191cee3c92f7c65fe16e8f97b7d56e0a8a95210ba94
Instruction Fuzzy Hash: 00B14071E00209CFDF10CFA9D98579DBBF2BF88314F18852AE815A7354EB74A845EB81

Uniqueness

Uniqueness Score: -1.00%

Function 0668C618 Relevance: .4, Instructions: 358COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4453229486.0000000006680000.00000040.00000800.00020000.00000000.sdmp, Offset: 06680000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6680000_Eaton PO-45150292964.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d53926fc8560e018512a62ed345c76ce552e4ae5ed44246e0e3f4bead0383f8
Instruction ID: 45825a40ca35c223250cb83752ed1b2c0a6e494b43c762aa20539256d8b1775f
Opcode Fuzzy Hash: 1d53926fc8560e018512a62ed345c76ce552e4ae5ed44246e0e3f4bead0383f8
Instruction Fuzzy Hash: 5EC1B530F101099FDB64EB78C494BAEB7E2EB85310F258626D419DB381DB35EC82C7A1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Eaton PO-45150292964.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Windows Analysis Report
Eaton PO-45150292964.exe

Function 04A50000 Relevance: 13.9, APIs: 9, Instructions: 352
threadinjectionmemoryCOMMON

Function 04A50054 Relevance: 13.8, APIs: 9, Instructions: 322
threadinjectionprocessCOMMON

Function 00C305C4 Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Function 00C31030 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 00C30D29 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Function 00C30D30 Relevance: 1.3, APIs: 1, Instructions: 47
memoryCOMMON

Function 04A50420 Relevance: 1.3, APIs: 1, Instructions: 15
memoryCOMMON

Function 06681030 Relevance: 8.0, Strings: 6, Instructions: 545
COMMON

Function 06685D30 Relevance: 3.0, Strings: 2, Instructions: 470
COMMON

Function 0668E0B9 Relevance: 2.8, Strings: 2, Instructions: 337
COMMON

Function 00FD4810 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Function 00FD4806 Relevance: 2.7, Strings: 2, Instructions: 180
COMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre