Edit tour

Windows Analysis Report
chitanta de plata 002093940409505050960000.exe

Overview

General Information

Sample name:	chitanta de plata 002093940409505050960000.exe
Analysis ID:	1618698
MD5:	dfc4049de3311d05b6027601575b7b11
SHA1:	67cc8c411bed9e48ce37f5f3eb18da0e45563439
SHA256:	5a4e470b3209d805f2c4f0707795907a5e5d2964d1ec35b9b42eb8e6d5dc9f82
Tags:	Agentteslaexeuser-Bastian455_
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

.NET source code references suspicious native API functions

Contains functionality to log keystrokes (.Net Source)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

chitanta de plata 002093940409505050960000.exe (PID: 4308 cmdline: "C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe" MD5: DFC4049DE3311D05B6027601575B7B11)

chitanta de plata 002093940409505050960000.exe (PID: 5900 cmdline: "C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe" MD5: DFC4049DE3311D05B6027601575B7B11)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1663775995.0000000003871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1663775995.0000000003871000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4129150956.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4127545728.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4127545728.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4129150956.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4129150956.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1663775995.0000000003691000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1663775995.0000000003691000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: chitanta de plata 002093940409505050960000.exe PID: 4308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: chitanta de plata 002093940409505050960000.exe PID: 4308	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: chitanta de plata 002093940409505050960000.exe PID: 5900	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: chitanta de plata 002093940409505050960000.exe PID: 5900	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bf9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30e3d:$s2: GetPrivateProfileString 0x30540:$s3: get_OSFullName 0x31c11:$s5: remove_Key 0x31dd9:$s5: remove_Key 0x32d01:$s6: FtpWebRequest 0x33adf:$s7: logins 0x34051:$s7: logins 0x36d62:$s7: logins 0x36e14:$s7: logins 0x38766:$s7: logins 0x379ae:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x31cfd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31d6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x31df9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31e8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x31ef5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31f67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x31ffd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x3208d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2f03d:$s2: GetPrivateProfileString 0x2e740:$s3: get_OSFullName 0x2fe11:$s5: remove_Key 0x2ffd9:$s5: remove_Key 0x30f01:$s6: FtpWebRequest 0x31cdf:$s7: logins 0x32251:$s7: logins 0x34f62:$s7: logins 0x35014:$s7: logins 0x36966:$s7: logins 0x35bae:$s9: 1.85 (Hash, version 2, native byte-order)
0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x33afd:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33b6f:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x33bf9:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33c8b:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x33cf5:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33d67:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x33dfd:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33e8d:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x30e3d:$s2: GetPrivateProfileString 0x30540:$s3: get_OSFullName 0x31c11:$s5: remove_Key 0x31dd9:$s5: remove_Key 0x32d01:$s6: FtpWebRequest 0x33adf:$s7: logins 0x34051:$s7: logins 0x36d62:$s7: logins 0x36e14:$s7: logins 0x38766:$s7: logins 0x379ae:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 7 entries

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: chitanta de plata 002093940409505050960000.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://concaribe.com	Avira URL Cloud: Label: malware
Source: http://ftp.concaribe.com	Avira URL Cloud: Label: malware

Found malware configuration

Source: 1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.concaribe.com", "Username": "testi@concaribe.com", "Password": "ro}UWgz#!38E"}

Multi AV Scanner detection for submitted file

Source: chitanta de plata 002093940409505050960000.exe	Virustotal: Detection: 62%			Perma Link
Source: chitanta de plata 002093940409505050960000.exe	ReversingLabs: Detection: 75%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: chitanta de plata 002093940409505050960000.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: chitanta de plata 002093940409505050960000.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Runpe\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\Piver.pdb source: chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663634957.0000000002570000.00000004.08000000.00040000.00000000.sdmp, chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663708233.0000000002691000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Runpe\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\Piver.pdb_JyJ kJ_CorDllMainmscoree.dll source: chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663634957.0000000002570000.00000004.08000000.00040000.00000000.sdmp, chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663708233.0000000002691000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Nova\source\repos\NailSalon\NailSalon\obj\Debug\NailSalon.pdb source: chitanta de plata 002093940409505050960000.exe

Source: Joe Sandbox View	IP Address: 192.185.13.234 192.185.13.234
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152
Source: Joe Sandbox View	IP Address: 172.67.74.152 172.67.74.152

Source: Joe Sandbox View

ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: ftp.concaribe.com

Source: chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4129150956.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://concaribe.com
Source: chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4129150956.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ftp.concaribe.com
Source: chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4129150956.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663775995.0000000003871000.00000004.00000800.00020000.00000000.sdmp, chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4127545728.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663775995.0000000003871000.00000004.00000800.00020000.00000000.sdmp, chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4127545728.0000000000402000.00000040.00000400.00020000.00000000.sdmp, chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4129150956.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4129150956.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4129150956.0000000002AA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 172.67.74.152:443 -> 192.168.2.4:49731 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, cPKWk.cs

.Net Code: ojpIFBdoe

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 0_2_00BF4598	0_2_00BF4598
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_029DE760	1_2_029DE760
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_029DAAAB	1_2_029DAAAB
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_029D4A58	1_2_029D4A58
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_029D3E40	1_2_029D3E40
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_029D4188	1_2_029D4188
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_0669A8B4	1_2_0669A8B4
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_0669A598	1_2_0669A598
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_0669BDF0	1_2_0669BDF0
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_0669DBF0	1_2_0669DBF0
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066B66C0	1_2_066B66C0
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066B56A0	1_2_066B56A0
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066BC240	1_2_066BC240
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066BB2F0	1_2_066BB2F0
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066B3158	1_2_066B3158
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066B7E40	1_2_066B7E40
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066B7760	1_2_066B7760
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066BE468	1_2_066BE468
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066B2370	1_2_066B2370
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066B0040	1_2_066B0040
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066B5DB7	1_2_066B5DB7
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066B0038	1_2_066B0038
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_066B0007	1_2_066B0007

Source: chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663708233.0000000002691000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePiver.dllH vs chitanta de plata 002093940409505050960000.exe
Source: chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663708233.0000000002691000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs chitanta de plata 002093940409505050960000.exe
Source: chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663141284.00000000008BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs chitanta de plata 002093940409505050960000.exe
Source: chitanta de plata 002093940409505050960000.exe, 00000000.00000000.1659742702.0000000000272000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameNailSalon.exe4 vs chitanta de plata 002093940409505050960000.exe
Source: chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663634957.000000000257C000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenamePiver.dllH vs chitanta de plata 002093940409505050960000.exe
Source: chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4127668482.0000000000938000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs chitanta de plata 002093940409505050960000.exe
Source: chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4127545728.000000000043E000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb6643012-12fd-45a5-9ab2-ac7e7ee5488b.exe4 vs chitanta de plata 002093940409505050960000.exe
Source: chitanta de plata 002093940409505050960000.exe	Binary or memory string: OriginalFilenameNailSalon.exe4 vs chitanta de plata 002093940409505050960000.exe

Source: chitanta de plata 002093940409505050960000.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload

Source: chitanta de plata 002093940409505050960000.exe, LightenSystem.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@2/2

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\chitanta de plata 002093940409505050960000.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Mutant created: NULL

Source: chitanta de plata 002093940409505050960000.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: chitanta de plata 002093940409505050960000.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chitanta de plata 002093940409505050960000.exe	Virustotal: Detection: 62%
Source: chitanta de plata 002093940409505050960000.exe	ReversingLabs: Detection: 75%

Source: unknown	Process created: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe "C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe"
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process created: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe "C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe"
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process created: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe "C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe"	Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: chitanta de plata 002093940409505050960000.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: chitanta de plata 002093940409505050960000.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: chitanta de plata 002093940409505050960000.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Runpe\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\Piver.pdb source: chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663634957.0000000002570000.00000004.08000000.00040000.00000000.sdmp, chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663708233.0000000002691000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: G:\IMPORTANT SRC\GOOD Nova\Crypter\Runpe\WindowsFormsApp1\WindowsFormsApp1\obj\Debug\Piver.pdb_JyJ kJ_CorDllMainmscoree.dll source: chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663634957.0000000002570000.00000004.08000000.00040000.00000000.sdmp, chitanta de plata 002093940409505050960000.exe, 00000000.00000002.1663708233.0000000002691000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Nova\source\repos\NailSalon\NailSalon\obj\Debug\NailSalon.pdb source: chitanta de plata 002093940409505050960000.exe

Source: chitanta de plata 002093940409505050960000.exe

Static PE information: 0xC11EB946 [Fri Sep 2 04:29:58 2072 UTC]

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_029D0C55 push edi; retf	1_2_029D0C7A
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_0669FEF3 push es; ret	1_2_0669FEF4
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Code function: 1_2_06693FB7 push 240679DAh; retf	1_2_06693FD5

Source: chitanta de plata 002093940409505050960000.exe

Static PE information: section name: .text entropy: 7.808475813697908

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Memory allocated: BF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Memory allocated: 2690000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Memory allocated: 23F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Memory allocated: 2AA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Memory allocated: 27E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597217	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596848	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594492	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594032	Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Window / User API: threadDelayed 8279			Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Window / User API: threadDelayed 1551			Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 1544	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -34126476536362649s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 2992	Thread sleep count: 8279 > 30	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 2992	Thread sleep count: 1551 > 30	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -599766s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -599657s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -599532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -599407s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -599297s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -599188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -599063s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -598938s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -598813s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -598688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -598235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -598110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -597985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -597860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -597735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -597594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -597359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -597217s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -597110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -596985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -596848s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -596610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -596485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -596360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -596235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -596110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -595985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -595860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -595735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -595610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -595485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -595360s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -595235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -595110s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -594985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -594860s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -594735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -594610s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -594492s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -594375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -594266s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -594141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe TID: 3340	Thread sleep time: -594032s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599657	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599532	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599407	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598938	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598813	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598688	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598235	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 598110	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597985	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597860	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597735	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597359	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597217	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 597110	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596985	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596848	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596610	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596485	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 596110	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595985	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595860	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595735	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595610	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595485	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595360	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595235	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 595110	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594985	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594860	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594735	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594610	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594492	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Thread delayed: delay time: 594032	Jump to behavior

Source: chitanta de plata 002093940409505050960000.exe, 00000001.00000002.4127829542.0000000000BE7000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

.NET source code references suspicious native API functions

Source: 0.2.chitanta de plata 002093940409505050960000.exe.26ef8b0.1.raw.unpack, Nive.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.chitanta de plata 002093940409505050960000.exe.26ef8b0.1.raw.unpack, Nive.cs	Reference to suspicious API methods: Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref name), ref method), typeof(CreateApi))
Source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, Ljq6xD21ACX.cs	Reference to suspicious API methods: OZkujShDCVG.OpenProcess(aPNZ30.DuplicateHandle, bInheritHandle: true, (uint)snUp2.ProcessID)

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Memory written: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Process created: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe "C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe"

Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Queries volume information: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Queries volume information: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1663775995.0000000003871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4129150956.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4127545728.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4129150956.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1663775995.0000000003691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: chitanta de plata 002093940409505050960000.exe PID: 4308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: chitanta de plata 002093940409505050960000.exe PID: 5900, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\chitanta de plata 002093940409505050960000.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1663775995.0000000003871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4127545728.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4129150956.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1663775995.0000000003691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: chitanta de plata 002093940409505050960000.exe PID: 4308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: chitanta de plata 002093940409505050960000.exe PID: 5900, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 1.2.chitanta de plata 002093940409505050960000.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.chitanta de plata 002093940409505050960000.exe.3832688.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1663775995.0000000003871000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4129150956.0000000002B1C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4127545728.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4129150956.0000000002AF1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1663775995.0000000003691000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: chitanta de plata 002093940409505050960000.exe PID: 4308, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: chitanta de plata 002093940409505050960000.exe PID: 5900, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Input Capture	24 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Software Packing	NTDS	111 Security Software Discovery	Distributed Component Object Model	1 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
chitanta de plata 002093940409505050960000.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report chitanta de plata 002093940409505050960000.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
chitanta de plata 002093940409505050960000.exe