Windows Analysis Report
SWH_67367383992_939930039003___________________________.exe

Overview

General Information

Sample name: SWH_67367383992_939930039003___________________________.exe
Analysis ID: 1430155
MD5: 5705caf18efe32863c38f4d50ec88cc1
SHA1: 15c23f1618bef4336b98212acb97136fbfb67c36
SHA256: 301a02cc0eb727a274bb807cb64022861b228129709070739721c9a4548918ea
Tags: AgentTeslaexe
Infos:

Detection

AgentTesla
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Double Extension File Execution
Yara detected AgentTesla
Binary is likely a compiled AutoIt script file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Writes to foreign memory regions
Contains functionality for read data from the clipboard
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to execute programs as a different user
Contains functionality to launch a process as a different user
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to retrieve information about pressed keystrokes
Contains functionality to shutdown / reboot the system
Contains functionality to simulate keystroke presses
Contains functionality to simulate mouse events
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Extensive use of GetProcAddress (often used to hide API calls)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
OS version to string mapping found (often used in BOTs)
Potential key logger detected (key state polling based)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Name Description Attribution Blogpost URLs Link
Agent Tesla, AgentTesla A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.
  • SWEED
 https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

AV Detection
barindex
Found malware configuration
Source: SWH_67367383992_939930039003___________________________.exe.7436.0.memstrmin Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.worlorderbillions.top", "Username": "absach@worlorderbillions.top", "Password": "@qwerty90123 "}
Multi AV Scanner detection for submitted file
Source: SWH_67367383992_939930039003___________________________.exe ReversingLabs: Detection: 36%
Source: SWH_67367383992_939930039003___________________________.exe Virustotal: Detection: 28% Perma Link
Machine Learning detection for sample
Source: SWH_67367383992_939930039003___________________________.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: Binary string: wntdll.pdbUGP source: SWH_67367383992_939930039003___________________________.exe, 00000000.00000003.1306041945.0000000003B10000.00000004.00001000.00020000.00000000.sdmp, SWH_67367383992_939930039003___________________________.exe, 00000000.00000003.1310743975.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SWH_67367383992_939930039003___________________________.exe, 00000000.00000003.1306041945.0000000003B10000.00000004.00001000.00020000.00000000.sdmp, SWH_67367383992_939930039003___________________________.exe, 00000000.00000003.1310743975.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A4696 GetFileAttributesW,FindFirstFileW,FindClose, 0_2_003A4696
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AC93C FindFirstFileW,FindClose, 0_2_003AC93C
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_003AC9C7
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_003AF200
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_003AF35D
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_003AF65E
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_003A3A2B
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_003A3D4E
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003ABF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_003ABF27
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003B25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile, 0_2_003B25E2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003B425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_003B425A
Contains functionality to modify clipboard data
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003B4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard, 0_2_003B4458
Contains functionality to read the clipboard data
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003B425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard, 0_2_003B425A
Contains functionality to retrieve information about pressed keystrokes
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState, 0_2_003A0219
Potential key logger detected (key state polling based)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003CCDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW, 0_2_003CCDAC

System Summary
barindex
Binary is likely a compiled AutoIt script file
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: This is a third-party compiled AutoIt script. 0_2_00343B4C
Source: SWH_67367383992_939930039003___________________________.exe String found in binary or memory: This is a third-party compiled AutoIt script.
Source: SWH_67367383992_939930039003___________________________.exe, 00000000.00000002.1312501015.00000000003F5000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: This is a third-party compiled AutoIt script. memstr_3cf0a5df-3
Source: SWH_67367383992_939930039003___________________________.exe, 00000000.00000002.1312501015.00000000003F5000.00000002.00000001.01000000.00000003.sdmp String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_f98f09fd-2
Source: SWH_67367383992_939930039003___________________________.exe String found in binary or memory: This is a third-party compiled AutoIt script. memstr_18136637-4
Source: SWH_67367383992_939930039003___________________________.exe String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer memstr_087411c6-0
Contains functionality to communicate with device drivers
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A4021: CreateFileW,DeviceIoControl,CloseHandle, 0_2_003A4021
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00398858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock, 0_2_00398858
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState, 0_2_003A545F
Detected potential crypto function
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0034E800 0_2_0034E800
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0036DBB5 0_2_0036DBB5
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0034E060 0_2_0034E060
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003C804A 0_2_003C804A
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00354140 0_2_00354140
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00362405 0_2_00362405
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00376522 0_2_00376522
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0034C5B1 0_2_0034C5B1
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0037267E 0_2_0037267E
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003C0665 0_2_003C0665
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0036283A 0_2_0036283A
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00356843 0_2_00356843
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003789DF 0_2_003789DF
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00358A0E 0_2_00358A0E
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00376A94 0_2_00376A94
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003C0AE2 0_2_003C0AE2
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A8B13 0_2_003A8B13
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0039EB07 0_2_0039EB07
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0036CD61 0_2_0036CD61
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00377006 0_2_00377006
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0035710E 0_2_0035710E
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00353190 0_2_00353190
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00341287 0_2_00341287
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003633C7 0_2_003633C7
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0036F419 0_2_0036F419
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00355680 0_2_00355680
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003616C4 0_2_003616C4
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003678D3 0_2_003678D3
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003558C0 0_2_003558C0
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00361BB8 0_2_00361BB8
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00379D05 0_2_00379D05
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0034FE40 0_2_0034FE40
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0036BFE6 0_2_0036BFE6
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00361FD0 0_2_00361FD0
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_03AD3660 0_2_03AD3660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 2_2_02F2D048 2_2_02F2D048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 2_2_02F24110 2_2_02F24110
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 2_2_02F295D8 2_2_02F295D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 2_2_02F29DD0 2_2_02F29DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 2_2_02F24D28 2_2_02F24D28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 2_2_02F24458 2_2_02F24458
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 2_2_06590040 2_2_06590040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 2_2_06593268 2_2_06593268
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Code function: 2_2_06591918 2_2_06591918
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: String function: 00360D27 appears 70 times
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: String function: 00368B40 appears 42 times
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: String function: 00347F41 appears 35 times
Sample file is different than original file name gathered from version info
Source: SWH_67367383992_939930039003___________________________.exe, 00000000.00000003.1310743975.0000000003E0D000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SWH_67367383992_939930039003___________________________.exe
Source: SWH_67367383992_939930039003___________________________.exe, 00000000.00000003.1306041945.0000000003C33000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SWH_67367383992_939930039003___________________________.exe
Source: SWH_67367383992_939930039003___________________________.exe, 00000000.00000002.1313737163.0000000003AE0000.00000004.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamee98985aa-1a0a-4027-b0e4-a37605f1db47.exe4 vs SWH_67367383992_939930039003___________________________.exe
Uses 32bit PE files
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.raw.unpack, O.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.raw.unpack, O.cs Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.raw.unpack, P.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.raw.unpack, P.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.raw.unpack, N.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.raw.unpack, N.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.raw.unpack, N.cs Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.raw.unpack, N.cs Cryptographic APIs: 'TransformFinalBlock'
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/4@0/0
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AA2D5 GetLastError,FormatMessageW, 0_2_003AA2D5
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00398713 AdjustTokenPrivileges,CloseHandle, 0_2_00398713
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00398CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError, 0_2_00398CC3
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode, 0_2_003AB59E
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003BF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle, 0_2_003BF121
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AC602 CoInitialize,CoCreateInstance,CoUninitialize, 0_2_003AC602
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00344FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource, 0_2_00344FE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Mutant created: NULL
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe File created: C:\Users\user\AppData\Local\Temp\aut9DC1.tmp Jump to behavior
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: RegSvcs.exe, 00000002.00000002.2542476489.0000000003147000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2542476489.0000000003133000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: SWH_67367383992_939930039003___________________________.exe ReversingLabs: Detection: 36%
Source: SWH_67367383992_939930039003___________________________.exe Virustotal: Detection: 28%
Source: unknown Process created: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe "C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe"
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe"
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe" Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: wsock32.dll Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: winmm.dll Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: mpr.dll Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: SWH_67367383992_939930039003___________________________.exe Static file information: File size 1088000 > 1048576
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wntdll.pdbUGP source: SWH_67367383992_939930039003___________________________.exe, 00000000.00000003.1306041945.0000000003B10000.00000004.00001000.00020000.00000000.sdmp, SWH_67367383992_939930039003___________________________.exe, 00000000.00000003.1310743975.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SWH_67367383992_939930039003___________________________.exe, 00000000.00000003.1306041945.0000000003B10000.00000004.00001000.00020000.00000000.sdmp, SWH_67367383992_939930039003___________________________.exe, 00000000.00000003.1310743975.0000000003CE0000.00000004.00001000.00020000.00000000.sdmp
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SWH_67367383992_939930039003___________________________.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003BC304 LoadLibraryA,GetProcAddress, 0_2_003BC304
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0034C590 push eax; retn 0034h 0_2_0034C599
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00368B85 push ecx; ret 0_2_00368B98
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00344A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_00344A35
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003C55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed, 0_2_003C55FD
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003633C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_003633C7
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe API coverage: 4.9 %
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A4696 GetFileAttributesW,FindFirstFileW,FindClose, 0_2_003A4696
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AC93C FindFirstFileW,FindClose, 0_2_003AC93C
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf, 0_2_003AC9C7
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_003AF200
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose, 0_2_003AF35D
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003AF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_003AF65E
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_003A3A2B
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose, 0_2_003A3D4E
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003ABF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose, 0_2_003ABF27
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00344AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_00344AFE
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe API call chain: ExitProcess graph end node
Contains functionality to block mouse and keyboard input (often used to hinder debugging)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003B41FD BlockInput, 0_2_003B41FD
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00343B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 0_2_00343B4C
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00375CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_00375CCC
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003BC304 LoadLibraryA,GetProcAddress, 0_2_003BC304
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_03AD3550 mov eax, dword ptr fs:[00000030h] 0_2_03AD3550
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_03AD34F0 mov eax, dword ptr fs:[00000030h] 0_2_03AD34F0
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_03AD1ED0 mov eax, dword ptr fs:[00000030h] 0_2_03AD1ED0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003981F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 0_2_003981F7
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0036A364 SetUnhandledExceptionFilter, 0_2_0036A364
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0036A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_0036A395
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: FF8008 Jump to behavior
Contains functionality to execute programs as a different user
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00398C93 LogonUserW, 0_2_00398C93
Contains functionality to launch a program with higher privileges
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00343B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW, 0_2_00343B4C
Contains functionality to simulate keystroke presses
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00344A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput, 0_2_00344A35
Contains functionality to simulate mouse events
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A4EF5 mouse_event, 0_2_003A4EF5
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe" Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003981F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity, 0_2_003981F7
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003A4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid, 0_2_003A4C03
Source: SWH_67367383992_939930039003___________________________.exe Binary or memory string: Run Script:AutoIt script files (*.au3, *.a3x)*.au3;*.a3xAll files (*.*)*.*au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: SWH_67367383992_939930039003___________________________.exe Binary or memory string: Shell_TrayWnd
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0036886B cpuid 0_2_0036886B
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003750D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_003750D7
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00382230 GetUserNameW, 0_2_00382230
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_0037418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte, 0_2_0037418A
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_00344AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo, 0_2_00344AFE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected AgentTesla
Source: Yara match File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2541569784.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1313737163.0000000003AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
OS version to string mapping found (often used in BOTs)
Source: SWH_67367383992_939930039003___________________________.exe Binary or memory string: WIN_81
Source: SWH_67367383992_939930039003___________________________.exe Binary or memory string: WIN_XP
Source: SWH_67367383992_939930039003___________________________.exe Binary or memory string: WIN_XPe
Source: SWH_67367383992_939930039003___________________________.exe Binary or memory string: WIN_VISTA
Source: SWH_67367383992_939930039003___________________________.exe Binary or memory string: WIN_7
Source: SWH_67367383992_939930039003___________________________.exe Binary or memory string: WIN_8
Source: SWH_67367383992_939930039003___________________________.exe Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality
barindex
Yara detected AgentTesla
Source: Yara match File source: 2.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SWH_67367383992_939930039003___________________________.exe.3ae0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.2541569784.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1313737163.0000000003AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003B6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket, 0_2_003B6596
Source: C:\Users\user\Desktop\SWH_67367383992_939930039003___________________________.exe Code function: 0_2_003B6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket, 0_2_003B6A5A
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1430155 Sample: SWH_67367383992_93993003900... Startdate: 23/04/2024 Architecture: WINDOWS Score: 100 12 Found malware configuration 2->12 14 Multi AV Scanner detection for submitted file 2->14 16 Yara detected AgentTesla 2->16 18 3 other signatures 2->18 6 SWH_67367383992_939930039003___________________________.exe 4 2->6         started        process3 signatures4 20 Binary is likely a compiled AutoIt script file 6->20 22 Writes to foreign memory regions 6->22 24 Maps a DLL or memory area into another process 6->24 9 RegSvcs.exe 2 6->9         started        process5 signatures6 26 Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines) 9->26 28 Tries to steal Mail credentials (via file / registry access) 9->28 30 Tries to harvest and steal browser information (history, passwords, etc) 9->30
⊘No contacted IP infos