Loading ...

Play interactive tourEdit tour

Analysis Report fac1020.exe

Overview

General Information

Sample Name:fac1020.exe
MD5:4a8d534044a34e448d0d5a3a3ad4875b
SHA1:ed3faef9c3c3d24a1eb53f2b8063e2f27fcf7d6a
SHA256:443c714627b570e3057e8fcd01ec67b38b205ea5fa59fee648bfdba42f533d0e

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected AgentTesla
.NET source code contains very large array initializations
Allocates memory in foreign processes
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to detect virtual machines (SGDT)
Contains functionality to launch a process as a different user
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • fac1020.exe (PID: 5652 cmdline: 'C:\Users\user\Desktop\fac1020.exe' MD5: 4A8D534044A34E448D0D5A3A3AD4875B)
    • InstallUtil.exe (PID: 5868 cmdline: C:\Users\user\AppData\Local\Temp\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "YKuXz6JF5b", "URL: ": "https://qFmtH6R84WECGdXULZe.com", "To: ": "david01smith@yandex.com", "ByHost: ": "smtp.yandex.com:5878", "Password: ": "j9iDGBlx", "From: ": "david01smith@yandex.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000003.582673892.000000000B4D6000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000000.00000002.591709316.0000000004553000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000000.00000002.591531831.00000000044E7000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000003.584557152.000000000B5DD000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000000.00000002.589010328.0000000002C90000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 8 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            2.2.InstallUtil.exe.620000.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              No Sigma rule has matched

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Found malware configurationShow sources
              Source: InstallUtil.exe.5868.2.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "YKuXz6JF5b", "URL: ": "https://qFmtH6R84WECGdXULZe.com", "To: ": "david01smith@yandex.com", "ByHost: ": "smtp.yandex.com:5878", "Password: ": "j9iDGBlx", "From: ": "david01smith@yandex.com"}

              Source: global trafficTCP traffic: 192.168.2.7:49711 -> 77.88.21.158:587
              Source: Joe Sandbox ViewIP Address: 77.88.21.158 77.88.21.158
              Source: global trafficTCP traffic: 192.168.2.7:49711 -> 77.88.21.158:587
              Source: unknownDNS traffic detected: queries for: smtp.yandex.com
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ca.crl0h
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
              Source: fac1020.exe, 00000000.00000002.588418652.00000000010F0000.00000004.00000020.sdmpString found in binary or memory: http://crl.micros
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ca.cer09
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ycasha2.cer0
              Source: InstallUtil.exe, 00000002.00000002.892464174.0000000002520000.00000004.00000001.sdmpString found in binary or memory: http://smtp.yandex.com
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com0.
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://www.certum.pl/CPS0
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: http://yandex.ocsp-responder.com03
              Source: InstallUtil.exe, 00000002.00000002.892464174.0000000002520000.00000004.00000001.sdmpString found in binary or memory: https://qFmtH6R84WECGdXULZe.com
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpString found in binary or memory: https://www.certum.pl/CPS0

              Source: fac1020.exe, 00000000.00000002.588080837.0000000001070000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

              System Summary:

              barindex
              .NET source code contains very large array initializationsShow sources
              Source: fac1020.exe, yu00406/u003cModuleu003e.csLarge array initialization: 9Ks: array initializer size 11136
              Source: 0.2.fac1020.exe.900000.0.unpack, yu00406/u003cModuleu003e.csLarge array initialization: 9Ks: array initializer size 11136
              Source: 0.0.fac1020.exe.900000.0.unpack, yu00406/u003cModuleu003e.csLarge array initialization: 9Ks: array initializer size 11136
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_051F5A08 NtQueryInformationProcess,
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_051F5A03 NtQueryInformationProcess,
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_0521A37C CreateProcessAsUserW,
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_01419238
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_01412CE9
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_0521B291
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_0521B2C0
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_05216DD4
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_05216DD8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_002520B0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_0247FB30
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_0247FB20
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A42416
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A4E788
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A40040
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A4F3A0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A483F0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A43C08
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A42F40
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A4F8A0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A4EAD0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A474D9
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A40024
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A44031
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A48128
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A4C170
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A48289
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A483E0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A42E52
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A4F891
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A478C1
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A47965
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FBEA40
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB2CF0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB846D
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB9D00
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FBC7E0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB98D8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FBB87C
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB91F0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB19E8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB4AF0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB4AE0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB8248
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB9200
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB8B50
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB8B40
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_05BA0040
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_05BA4CE1
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_05BA3038
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_05BA3C40
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_05BA1878
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_05BA2080
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_05BA0006
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_05BACE0C
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_05BA3C31
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\InstallUtil.exe 46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB
              Source: fac1020.exe, 00000000.00000003.582673892.000000000B4D6000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameAHLyKQpSjZFIcaBZOxPvcKjhzqQHVbhpOhGKJa.exe4 vs fac1020.exe
              Source: fac1020.exe, 00000000.00000002.586795800.00000000009BA000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameee.exeH vs fac1020.exe
              Source: fac1020.exe, 00000000.00000002.588818216.0000000002A90000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamekilo.dll4 vs fac1020.exe
              Source: fac1020.exe, 00000000.00000002.589010328.0000000002C90000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamelelea.exe, vs fac1020.exe
              Source: fac1020.exe, 00000000.00000002.594998358.00000000052C0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamefdfrf.dll4 vs fac1020.exe
              Source: fac1020.exe, 00000000.00000002.594809941.0000000005220000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamefvsfesdf.dll2 vs fac1020.exe
              Source: fac1020.exe, 00000000.00000002.588080837.0000000001070000.00000004.00000020.sdmpBinary or memory string: OriginalFilenameclr.dllT vs fac1020.exe
              Source: fac1020.exeBinary or memory string: OriginalFilenameee.exeH vs fac1020.exe
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/2@2/1
              Source: C:\Users\user\Desktop\fac1020.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fac1020.exe.logJump to behavior
              Source: C:\Users\user\Desktop\fac1020.exeFile created: C:\Users\user\AppData\Local\Temp\InstallUtil.exeJump to behavior
              Source: fac1020.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\fac1020.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\5e7364da399b604ae01baff696551080\mscorlib.ni.dll
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\5e7364da399b604ae01baff696551080\mscorlib.ni.dll
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\fac1020.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\fac1020.exe 'C:\Users\user\Desktop\fac1020.exe'
              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
              Source: C:\Users\user\Desktop\fac1020.exeProcess created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32
              Source: C:\Users\user\Desktop\fac1020.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: fac1020.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: fac1020.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
              Source: Binary string: C:\Users\Switch\source\repos\stub\CopyEx\OchiiMei\OchiiMei\obj\Release\kilo.pdb source: fac1020.exe, 00000000.00000002.588818216.0000000002A90000.00000004.00000001.sdmp
              Source: Binary string: C:\Users\Switch\source\repos\stub\CopyEx\OchiiMei\OchiiMei\obj\Release\kilo.pdb4*N* @*_CorDllMainmscoree.dll source: fac1020.exe, 00000000.00000002.588818216.0000000002A90000.00000004.00000001.sdmp
              Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: fac1020.exe, 00000000.00000002.588418652.00000000010F0000.00000004.00000020.sdmp, InstallUtil.exe, 00000002.00000002.889000282.0000000000252000.00000002.00020000.sdmp, InstallUtil.exe.0.dr
              Source: Binary string: InstallUtil.pdb source: fac1020.exe, 00000000.00000002.588418652.00000000010F0000.00000004.00000020.sdmp, InstallUtil.exe, InstallUtil.exe.0.dr
              Source: Binary string: C:\Users\Switch\source\repos\stub\rr\OchiiMei\obj\Release\fdfrf.pdb source: fac1020.exe, 00000000.00000002.594998358.00000000052C0000.00000004.00000001.sdmp

              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_0091098B push cs; iretd
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_009108D5 push cs; iretd
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_0091144B push es; retf
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_01413860 pushad ; iretd
              Source: C:\Users\user\Desktop\fac1020.exeCode function: 0_2_05219BCC push 8BFFFFFFh; iretd
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB3534 push es; retf
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB6E59 push ecx; ret
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FBA734 push eax; ret
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB39C9 push ebx; iretd
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FB32F5 push 69D04589h; ret

              Source: C:\Users\user\Desktop\fac1020.exeFile created: C:\Users\user\AppData\Local\Temp\InstallUtil.exeJump to dropped file

              Hooking and other Techniques for Hiding and Protection:

              barindex
              Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
              Source: C:\Users\user\Desktop\fac1020.exeFile opened: C:\Users\user\Desktop\fac1020.exe:Zone.Identifier read attributes | delete
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\fac1020.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion:

              barindex
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04A4B918 sgdt fword ptr [eax]
              Source: C:\Users\user\Desktop\fac1020.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\Desktop\fac1020.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWindow / User API: threadDelayed 788
              Source: C:\Users\user\Desktop\fac1020.exe TID: 5780Thread sleep time: -2767011611056431s >= -30000s
              Source: C:\Users\user\Desktop\fac1020.exe TID: 5860Thread sleep count: 186 > 30
              Source: C:\Users\user\Desktop\fac1020.exe TID: 5708Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5984Thread sleep count: 788 > 30
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -30000s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -59812s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -58406s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -57718s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -56812s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -56624s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -55906s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -55718s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -55000s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -54812s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -53906s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -53000s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -50000s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -49312s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -48906s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -47812s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -47312s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -47124s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -46594s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -46406s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -44594s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -44406s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -44218s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -42406s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5980Thread sleep time: -40124s >= -30000s
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeLast function: Thread delayed
              Source: InstallUtil.exe, 00000002.00000002.899757747.00000000056C0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: InstallUtil.exe, 00000002.00000002.899757747.00000000056C0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: InstallUtil.exe, 00000002.00000002.899757747.00000000056C0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: InstallUtil.exe, 00000002.00000002.900744868.0000000005BB0000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: InstallUtil.exe, 00000002.00000002.899757747.00000000056C0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\fac1020.exeProcess information queried: ProcessInformation

              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 2_2_04FBEA40 LdrInitializeThunk,
              Source: C:\Users\user\Desktop\fac1020.exeProcess token adjusted: Debug
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess token adjusted: Debug
              Source: C:\Users\user\Desktop\fac1020.exeMemory allocated: page read and write | page guard

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Allocates memory in foreign processesShow sources
              Source: C:\Users\user\Desktop\fac1020.exeMemory allocated: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 620000 protect: page execute and read and write
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\fac1020.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 620000 value starts with: 4D5A
              Writes to foreign memory regionsShow sources
              Source: C:\Users\user\Desktop\fac1020.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 620000
              Source: C:\Users\user\Desktop\fac1020.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 622000
              Source: C:\Users\user\Desktop\fac1020.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 668000
              Source: C:\Users\user\Desktop\fac1020.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 66A000
              Source: C:\Users\user\Desktop\fac1020.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 59F008
              Source: C:\Users\user\Desktop\fac1020.exeProcess created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
              Source: InstallUtil.exe, 00000002.00000002.891896227.0000000000F60000.00000002.00000001.sdmpBinary or memory string: Program Manager
              Source: InstallUtil.exe, 00000002.00000002.891896227.0000000000F60000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: InstallUtil.exe, 00000002.00000002.891896227.0000000000F60000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: InstallUtil.exe, 00000002.00000002.891896227.0000000000F60000.00000002.00000001.sdmpBinary or memory string: Progmanlock

              Source: C:\Users\user\Desktop\fac1020.exeQueries volume information: C:\Users\user\Desktop\fac1020.exe VolumeInformation
              Source: C:\Users\user\Desktop\fac1020.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\user\Desktop\fac1020.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformation
              Source: C:\Users\user\Desktop\fac1020.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Users\user\AppData\Local\Temp\InstallUtil.exe VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
              Source: C:\Users\user\Desktop\fac1020.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

              Stealing of Sensitive Information:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000000.00000003.582673892.000000000B4D6000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.591709316.0000000004553000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.591531831.00000000044E7000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.584557152.000000000B5DD000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.589010328.0000000002C90000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000002.00000002.889201321.0000000000622000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.582889495.000000000B4E7000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.582798105.000000000B4E6000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000002.00000002.892464174.0000000002520000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 5868, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: fac1020.exe PID: 5652, type: MEMORY
              Source: Yara matchFile source: 2.2.InstallUtil.exe.620000.1.unpack, type: UNPACKEDPE
              Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
              Tries to harvest and steal browser information (history, passwords, etc)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
              Tries to harvest and steal ftp login credentialsShow sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
              Tries to steal Mail credentials (via file access)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
              Source: Yara matchFile source: 00000002.00000002.892464174.0000000002520000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 5868, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000000.00000003.582673892.000000000B4D6000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.591709316.0000000004553000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.591531831.00000000044E7000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.584557152.000000000B5DD000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.589010328.0000000002C90000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000002.00000002.889201321.0000000000622000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.582889495.000000000B4E7000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.582798105.000000000B4E6000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000002.00000002.892464174.0000000002520000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 5868, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: fac1020.exe PID: 5652, type: MEMORY
              Source: Yara matchFile source: 2.2.InstallUtil.exe.620000.1.unpack, type: UNPACKEDPE

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid Accounts1Windows Management Instrumentation211Hidden Files and Directories1Valid Accounts1Masquerading1Credential Dumping2Virtualization/Sandbox Evasion14Application Deployment SoftwareEmail Collection1Data Encrypted1Standard Cryptographic Protocol1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Replication Through Removable MediaService ExecutionValid Accounts1Access Token Manipulation1Hidden Files and Directories1Input Capture1Process Discovery2Remote ServicesInput Capture1Exfiltration Over Other Network MediumUncommonly Used Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              External Remote ServicesWindows Management InstrumentationAccessibility FeaturesProcess Injection312Valid Accounts1Credentials in Registry1Application Window Discovery1Windows Remote ManagementData from Local System2Automated ExfiltrationStandard Non-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Drive-by CompromiseScheduled TaskSystem FirmwareDLL Search Order HijackingDisabling Security Tools1Credentials in FilesSecurity Software Discovery111Logon ScriptsInput CaptureData EncryptedStandard Application Layer Protocol11SIM Card SwapPremium SMS Toll Fraud
              Exploit Public-Facing ApplicationCommand-Line InterfaceShortcut ModificationFile System Permissions WeaknessAccess Token Manipulation1Account ManipulationRemote System Discovery1Shared WebrootData StagedScheduled TransferStandard Cryptographic ProtocolManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Spearphishing LinkGraphical User InterfaceModify Existing ServiceNew ServiceVirtualization/Sandbox Evasion14Brute ForceSystem Information Discovery114Third-party SoftwareScreen CaptureData Transfer Size LimitsCommonly Used PortJamming or Denial of ServiceAbuse Accessibility Features
              Spearphishing AttachmentScriptingPath InterceptionScheduled TaskProcess Injection312Two-Factor Authentication InterceptionNetwork SniffingPass the HashEmail CollectionExfiltration Over Command and Control ChannelUncommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Spearphishing via ServiceThird-party SoftwareLogon ScriptsProcess InjectionObfuscated Files or Information1Bash HistoryNetwork Service ScanningRemote Desktop ProtocolClipboard DataExfiltration Over Alternative ProtocolStandard Application Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet