Loading ...

Play interactive tourEdit tour

Analysis Report 2St2bOz2w4.exe

Overview

General Information

Sample Name:2St2bOz2w4.exe
MD5:716b4eab6d0ae5755884643ce96b8b3c
SHA1:8655755f3fb350d921269c96ce6d3f5190f5ff8d
SHA256:ce3042a91e52973326599b1d3fb755d7bda08c62e7a8f201d54ef6e33a4d5655

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Capture Wi-Fi password
Sigma detected: Scheduled temp file as task from temp location
Yara detected AgentTesla
.NET source code contains method to dynamically call methods (often used by packers)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal WLAN passwords
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Uses netsh to modify the Windows network and firewall settings
Uses schtasks.exe or at.exe to add and modify task schedules
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • 2St2bOz2w4.exe (PID: 3624 cmdline: 'C:\Users\user\Desktop\2St2bOz2w4.exe' MD5: 716B4EAB6D0AE5755884643CE96B8B3C)
    • schtasks.exe (PID: 5364 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TSQHFXEdRp' /XML 'C:\Users\user\AppData\Local\Temp\tmp63A0.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)
      • conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
    • 2St2bOz2w4.exe (PID: 5328 cmdline: {path} MD5: 716B4EAB6D0AE5755884643CE96B8B3C)
    • 2St2bOz2w4.exe (PID: 5508 cmdline: {path} MD5: 716B4EAB6D0AE5755884643CE96B8B3C)
      • netsh.exe (PID: 4324 cmdline: 'netsh' wlan show profile MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)
        • conhost.exe (PID: 4896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "Y7QIh", "URL: ": "https://TbDRPTvETGEFORDtd8.com", "To: ": "eljefe09@yandex.ru", "ByHost: ": "smtp.yandex.ru:587", "Password: ": "UoIKX", "From: ": "eljefe09@yandex.ru"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000005.00000002.1189101926.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000005.00000002.1192266877.0000000003420000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000005.00000002.1192797095.000000000358B000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000002.778506104.0000000004520000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          Process Memory Space: 2St2bOz2w4.exe PID: 5508JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 2 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            5.2.2St2bOz2w4.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview


              System Summary:

              barindex
              Sigma detected: Capture Wi-Fi passwordShow sources
              Source: Process startedAuthor: Joe Security: Data: Command: 'netsh' wlan show profile, CommandLine: 'netsh' wlan show profile, CommandLine|base64offset|contains: V, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: {path}, ParentImage: C:\Users\user\Desktop\2St2bOz2w4.exe, ParentProcessId: 5508, ProcessCommandLine: 'netsh' wlan show profile, ProcessId: 4324
              Sigma detected: Scheduled temp file as task from temp locationShow sources
              Source: Process startedAuthor: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TSQHFXEdRp' /XML 'C:\Users\user\AppData\Local\Temp\tmp63A0.tmp', CommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TSQHFXEdRp' /XML 'C:\Users\user\AppData\Local\Temp\tmp63A0.tmp', CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: 'C:\Users\user\Desktop\2St2bOz2w4.exe' , ParentImage: C:\Users\user\Desktop\2St2bOz2w4.exe, ParentProcessId: 3624, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TSQHFXEdRp' /XML 'C:\Users\user\AppData\Local\Temp\tmp63A0.tmp', ProcessId: 5364

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Found malware configurationShow sources
              Source: 2St2bOz2w4.exe.5508.5.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "Y7QIh", "URL: ": "https://TbDRPTvETGEFORDtd8.com", "To: ": "eljefe09@yandex.ru", "ByHost: ": "smtp.yandex.ru:587", "Password: ": "UoIKX", "From: ": "eljefe09@yandex.ru"}
              Multi AV Scanner detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\TSQHFXEdRp.exeVirustotal: Detection: 71%Perma Link
              Source: C:\Users\user\AppData\Roaming\TSQHFXEdRp.exeMetadefender: Detection: 40%Perma Link
              Source: C:\Users\user\AppData\Roaming\TSQHFXEdRp.exeReversingLabs: Detection: 77%
              Multi AV Scanner detection for submitted fileShow sources
              Source: 2St2bOz2w4.exeVirustotal: Detection: 71%Perma Link
              Source: 2St2bOz2w4.exeMetadefender: Detection: 40%Perma Link
              Source: 2St2bOz2w4.exeReversingLabs: Detection: 77%
              Machine Learning detection for dropped fileShow sources
              Source: C:\Users\user\AppData\Roaming\TSQHFXEdRp.exeJoe Sandbox ML: detected
              Machine Learning detection for sampleShow sources
              Source: 2St2bOz2w4.exeJoe Sandbox ML: detected
              Source: 5.2.2St2bOz2w4.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8

              Source: global trafficTCP traffic: 192.168.2.5:49735 -> 77.88.21.158:587
              Source: Joe Sandbox ViewIP Address: 77.88.21.158 77.88.21.158
              Source: global trafficTCP traffic: 192.168.2.5:49735 -> 77.88.21.158:587
              Source: unknownDNS traffic detected: queries for: smtp.yandex.ru
              Source: 2St2bOz2w4.exe, 00000005.00000002.1195317564.0000000006490000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ca.crl0h
              Source: 2St2bOz2w4.exe, 00000005.00000002.1195317564.0000000006490000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190503412.000000000145C000.00000004.00000020.sdmpString found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
              Source: 2St2bOz2w4.exe, 00000005.00000002.1195317564.0000000006490000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ca.cer09
              Source: 2St2bOz2w4.exe, 00000005.00000002.1195317564.0000000006490000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190503412.000000000145C000.00000004.00000020.sdmpString found in binary or memory: http://repository.certum.pl/ycasha2.cer0
              Source: 2St2bOz2w4.exe, 00000005.00000002.1195317564.0000000006490000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com0.
              Source: 2St2bOz2w4.exe, 00000005.00000002.1195317564.0000000006490000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
              Source: 2St2bOz2w4.exe, 00000005.00000002.1195317564.0000000006490000.00000004.00000001.sdmpString found in binary or memory: http://www.certum.pl/CPS0
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190503412.000000000145C000.00000004.00000020.sdmpString found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190503412.000000000145C000.00000004.00000020.sdmpString found in binary or memory: http://yandex.ocsp-responder.com03
              Source: 2St2bOz2w4.exe, 00000005.00000002.1192797095.000000000358B000.00000004.00000001.sdmpString found in binary or memory: https://TbDRPTvETGEFORDtd8.com
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190503412.000000000145C000.00000004.00000020.sdmpString found in binary or memory: https://www.certum.pl/CPS0

              System Summary:

              barindex
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_05687168
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_0568167C
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_056802B8
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_0568649D
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_0568836F
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_0568775A
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_05688380
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_05688428
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_0568721A
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B53C0
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030BBA57
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B02D0
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B7948
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030BA5C7
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B6DF8
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B1000
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B0070
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B04D8
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B3B65
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B3799
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B1000
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B53B3
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B3E05
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B36A6
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B02C1
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030BA90F
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B3517
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B3928
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B7938
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B2533
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B317B
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B35B3
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B39C4
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B6800
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B0006
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B3424
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B3835
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B3CAF
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B04C9
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A1200
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A0E78
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060ACAA0
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060AF6E0
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060ACFC0
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A3078
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A0070
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060AF9E8
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A0E68
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A07C8
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A0006
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A3069
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A0C9A
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A149F
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A2CA5
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060AD9E0
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Roaming\TSQHFXEdRp.exe CE3042A91E52973326599B1D3FB755D7BDA08C62E7A8F201D54EF6E33A4D5655
              Source: 2St2bOz2w4.exeBinary or memory string: OriginalFilename vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000000.00000002.781840200.00000000064B0000.00000002.00000001.sdmpBinary or memory string: originalfilename vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000000.00000002.781840200.00000000064B0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamepropsys.dll.mui@ vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000000.00000002.780434603.0000000005750000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUserInterface.dll< vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000000.00000002.777128605.000000000354A000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamepEGoKGrKAjXAqMYyzkPWp.exe4 vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000000.00000002.781484155.00000000063B0000.00000002.00000001.sdmpBinary or memory string: System.OriginalFileName vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000000.00000002.780260676.00000000056F0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exeBinary or memory string: OriginalFilename vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exeBinary or memory string: OriginalFilename vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000005.00000002.1194929505.0000000006060000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx.mui vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000005.00000002.1194899507.0000000006050000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewshom.ocx vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000005.00000002.1195089958.0000000006180000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000005.00000002.1189239394.000000000044E000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamepEGoKGrKAjXAqMYyzkPWp.exe4 vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000005.00000002.1194098768.0000000005680000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamewbemdisp.tlbj% vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000005.00000002.1194197416.00000000057A0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenameKernelbase.dll.muij% vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190243239.000000000139A000.00000004.00000020.sdmpBinary or memory string: OriginalFilenamemscorwks.dllT vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exeBinary or memory string: OriginalFilenameUserInterface.dll< vs 2St2bOz2w4.exe
              Source: 2St2bOz2w4.exeBinary or memory string: OriginalFilenamezATEcdDklIvkQbT.exe4 vs 2St2bOz2w4.exe
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeSection loaded: security.dll
              Source: 2St2bOz2w4.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: TSQHFXEdRp.exe.0.drStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@11/4@1/1
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_058306EA AdjustTokenPrivileges,
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_058306B3 AdjustTokenPrivileges,
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile created: C:\Users\user\AppData\Roaming\TSQHFXEdRp.exeJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4896:120:WilError_01
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeMutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeMutant created: \Sessions\1\BaseNamedObjects\jNrHQdgZAKa
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile created: C:\Users\user\AppData\Local\Temp\tmp63A0.tmpJump to behavior
              Source: 2St2bOz2w4.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\497ab1dd171eeef956401f1aeb0b9fec\mscorlib.ni.dll
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\497ab1dd171eeef956401f1aeb0b9fec\mscorlib.ni.dll
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: 2St2bOz2w4.exeVirustotal: Detection: 71%
              Source: 2St2bOz2w4.exeMetadefender: Detection: 40%
              Source: 2St2bOz2w4.exeReversingLabs: Detection: 77%
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile read: C:\Users\user\Desktop\2St2bOz2w4.exeJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\2St2bOz2w4.exe 'C:\Users\user\Desktop\2St2bOz2w4.exe'
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TSQHFXEdRp' /XML 'C:\Users\user\AppData\Local\Temp\tmp63A0.tmp'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Users\user\Desktop\2St2bOz2w4.exe {path}
              Source: unknownProcess created: C:\Users\user\Desktop\2St2bOz2w4.exe {path}
              Source: unknownProcess created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TSQHFXEdRp' /XML 'C:\Users\user\AppData\Local\Temp\tmp63A0.tmp'
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess created: C:\Users\user\Desktop\2St2bOz2w4.exe {path}
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess created: C:\Users\user\Desktop\2St2bOz2w4.exe {path}
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: 2St2bOz2w4.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll
              Source: 2St2bOz2w4.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
              Source: Binary string: mscorrc.pdb source: 2St2bOz2w4.exe, 00000000.00000002.780260676.00000000056F0000.00000002.00000001.sdmp, 2St2bOz2w4.exe, 00000005.00000002.1195089958.0000000006180000.00000002.00000001.sdmp

              Data Obfuscation:

              barindex
              .NET source code contains method to dynamically call methods (often used by packers)Show sources
              Source: 2St2bOz2w4.exe, PokerGame/XXXWWW.cs.Net Code: LateBinding.LateCall(V_3, null, "Invoke", new object[] { null, new object[] { J4.p, "PokerGame" } }, null, null)
              Source: TSQHFXEdRp.exe.0.dr, PokerGame/XXXWWW.cs.Net Code: LateBinding.LateCall(V_3, null, "Invoke", new object[] { null, new object[] { J4.p, "PokerGame" } }, null, null)
              Source: 0.2.2St2bOz2w4.exe.ea0000.0.unpack, PokerGame/XXXWWW.cs.Net Code: LateBinding.LateCall(V_3, null, "Invoke", new object[] { null, new object[] { J4.p, "PokerGame" } }, null, null)
              Source: 0.0.2St2bOz2w4.exe.ea0000.0.unpack, PokerGame/XXXWWW.cs.Net Code: LateBinding.LateCall(V_3, null, "Invoke", new object[] { null, new object[] { J4.p, "PokerGame" } }, null, null)
              Source: 4.0.2St2bOz2w4.exe.c0000.0.unpack, PokerGame/XXXWWW.cs.Net Code: LateBinding.LateCall(V_3, null, "Invoke", new object[] { null, new object[] { J4.p, "PokerGame" } }, null, null)
              Source: 4.2.2St2bOz2w4.exe.c0000.0.unpack, PokerGame/XXXWWW.cs.Net Code: LateBinding.LateCall(V_3, null, "Invoke", new object[] { null, new object[] { J4.p, "PokerGame" } }, null, null)
              Source: 5.2.2St2bOz2w4.exe.c90000.1.unpack, PokerGame/XXXWWW.cs.Net Code: LateBinding.LateCall(V_3, null, "Invoke", new object[] { null, new object[] { J4.p, "PokerGame" } }, null, null)
              Source: 5.0.2St2bOz2w4.exe.c90000.0.unpack, PokerGame/XXXWWW.cs.Net Code: LateBinding.LateCall(V_3, null, "Invoke", new object[] { null, new object[] { J4.p, "PokerGame" } }, null, null)
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B7260 push eax; ret
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A2A48 push es; ret
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_060A2ABD push es; ret
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_061E0640 push es; iretd
              Source: initial sampleStatic PE information: section name: .text entropy: 7.85489504247
              Source: initial sampleStatic PE information: section name: .text entropy: 7.85489504247

              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile created: C:\Users\user\AppData\Roaming\TSQHFXEdRp.exeJump to dropped file

              Boot Survival:

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
              Source: unknownProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TSQHFXEdRp' /XML 'C:\Users\user\AppData\Local\Temp\tmp63A0.tmp'

              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\netsh.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion:

              barindex
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 3836Thread sleep time: -33000s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 1084Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -60000s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -59000s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -82359s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -54000s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -44594s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -41094s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -40594s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -40000s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -56250s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -36000s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -52500s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -33406s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -32906s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -32500s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -48000s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -30000s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -44250s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -35250s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -59500s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -59312s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -58812s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -58406s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -57906s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -57686s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -56686s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -56000s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -83718s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -55124s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -54718s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -54436s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -53812s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -53312s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -52312s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -51312s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -50812s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -73968s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -48312s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -47124s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -46718s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -45624s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -44218s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -44030s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -43186s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -42530s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -39718s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -37812s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -37124s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -36406s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -35500s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -52218s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -34624s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -33906s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -50577s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -31812s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -46968s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -30406s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -30218s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -44718s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -35577s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -56906s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -56218s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -55312s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -51718s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -50218s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -48000s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -46500s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -41906s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exe TID: 4920Thread sleep time: -30718s >= -30000s
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeLast function: Thread delayed
              Source: 2St2bOz2w4.exe, 00000005.00000002.1194197416.00000000057A0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: 2St2bOz2w4.exe, 00000005.00000002.1194197416.00000000057A0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: 2St2bOz2w4.exe, 00000005.00000002.1194197416.00000000057A0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190503412.000000000145C000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: 2St2bOz2w4.exe, 00000005.00000002.1194197416.00000000057A0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess information queried: ProcessInformation

              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 5_2_030B2F7D KiUserExceptionDispatcher,LdrInitializeThunk,
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess token adjusted: Debug
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess token adjusted: Debug
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeMemory allocated: page read and write | page guard

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeMemory written: C:\Users\user\Desktop\2St2bOz2w4.exe base: 400000 value starts with: 4D5A
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /TN 'Updates\TSQHFXEdRp' /XML 'C:\Users\user\AppData\Local\Temp\tmp63A0.tmp'
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess created: C:\Users\user\Desktop\2St2bOz2w4.exe {path}
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess created: C:\Users\user\Desktop\2St2bOz2w4.exe {path}
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190769848.0000000001A90000.00000002.00000001.sdmpBinary or memory string: Program Manager
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190769848.0000000001A90000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190769848.0000000001A90000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: 2St2bOz2w4.exe, 00000005.00000002.1190769848.0000000001A90000.00000002.00000001.sdmpBinary or memory string: Progmanlock

              Source: C:\Users\user\Desktop\2St2bOz2w4.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeQueries volume information: C:\Windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
              Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\SysWOW64\netsh.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeCode function: 0_2_0159B176 GetUserNameW,
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

              Lowering of HIPS / PFW / Operating System Security Settings:

              barindex
              Uses netsh to modify the Windows network and firewall settingsShow sources
              Source: unknownProcess created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile

              Stealing of Sensitive Information:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000005.00000002.1189101926.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.1192266877.0000000003420000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.1192797095.000000000358B000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.778506104.0000000004520000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: 2St2bOz2w4.exe PID: 5508, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: 2St2bOz2w4.exe PID: 3624, type: MEMORY
              Source: Yara matchFile source: 5.2.2St2bOz2w4.exe.400000.0.unpack, type: UNPACKEDPE
              Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions
              Tries to harvest and steal WLAN passwordsShow sources
              Source: unknownProcess created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeProcess created: C:\Windows\SysWOW64\netsh.exe 'netsh' wlan show profile
              Tries to harvest and steal browser information (history, passwords, etc)Show sources
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
              Tries to harvest and steal ftp login credentialsShow sources
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\
              Tries to steal Mail credentials (via file access)Show sources
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
              Source: C:\Users\user\Desktop\2St2bOz2w4.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
              Source: Yara matchFile source: Process Memory Space: 2St2bOz2w4.exe PID: 5508, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000005.00000002.1189101926.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.1192266877.0000000003420000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.1192797095.000000000358B000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000002.778506104.0000000004520000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: 2St2bOz2w4.exe PID: 5508, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: 2St2bOz2w4.exe PID: 3624, type: MEMORY
              Source: Yara matchFile source: 5.2.2St2bOz2w4.exe.400000.0.unpack, type: UNPACKEDPE

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid AccountsWindows Management Instrumentation211Scheduled Task1Access Token Manipulation1Software Packing13Credential Dumping2Account Discovery1Application Deployment SoftwareData from Local System2Data Encrypted1Uncommonly Used Port1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Replication Through Removable MediaScheduled Task1Port MonitorsProcess Injection112Disabling Security Tools11Credentials in Registry1Security Software Discovery211Remote ServicesEmail Collection1Exfiltration Over Other Network MediumStandard Cryptographic Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              External Remote ServicesWindows Management InstrumentationAccessibility FeaturesScheduled Task1Obfuscated Files or Information2Input CaptureFile and Directory Discovery1Windows Remote ManagementData from Network Shared DriveAutomated ExfiltrationStandard Non-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Drive-by CompromiseScheduled TaskSystem FirmwareDLL Search Order HijackingMasquerading1Credentials in FilesSystem Information Discovery114Logon ScriptsInput CaptureData EncryptedStandard Application Layer Protocol11SIM Card SwapPremium SMS Toll Fraud
              Exploit Public-Facing ApplicationCommand-Line InterfaceShortcut ModificationFile System Permissions WeaknessVirtualization/Sandbox Evasion13Account ManipulationVirtualization/Sandbox Evasion13Shared WebrootData StagedScheduled TransferStandard Cryptographic ProtocolManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Spearphishing LinkGraphical User InterfaceModify Existing ServiceNew ServiceAccess Token Manipulation1Brute ForceProcess Discovery2Third-party SoftwareScreen CaptureData Transfer Size LimitsCommonly Used PortJamming or Denial of ServiceAbuse Accessibility Features
              Spearphishing AttachmentScriptingPath InterceptionScheduled TaskProcess Injection112Two-Factor Authentication InterceptionSystem Owner/User Discovery1Pass the HashEmail CollectionExfiltration Over Command and Control ChannelUncommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Spearphishing via ServiceThird-party SoftwareLogon ScriptsProcess InjectionDLL Side-Loading1Bash HistoryRemote System Discovery1Remote Desktop ProtocolClipboard DataExfiltration Over Alternative ProtocolStandard Application Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 signatures2 2 Behavior Graph