Loading ...

Play interactive tourEdit tour

Analysis Report Encomenda Fornecedor n#U00ba 72718_____PDF.exe

Overview

General Information

Sample Name:Encomenda Fornecedor n#U00ba 72718_____PDF.exe
Analysis ID:289534
MD5:24375a782f56c2f74089c324839498b7
SHA1:692d810e55ee330c478b50814febf6deb4d8a7a5
SHA256:ee568c524241c42a0f17daa23dedb52e377c89270ccd4cfd5ca4a8177b0f6719
Tags:agenttesla

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
.NET source code contains very large array initializations
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Antivirus or Machine Learning detection for unpacked file
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses SMTP (mail sending)
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "DaeBYCt", "URL: ": "https://R1cF2m25YjGPotRZ.org", "To: ": "tycoo2019@yandex.com", "ByHost: ": "smtp.yandex.com:587", "Password: ": "Tp5GwbbV4Cq", "From: ": "tycoo2019@yandex.com"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000012.00000002.467854650.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000012.00000002.471679841.0000000003150000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000012.00000002.471679841.0000000003150000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        Process Memory Space: InstallUtil.exe PID: 6348JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          Process Memory Space: InstallUtil.exe PID: 6348JoeSecurity_CredentialStealerYara detected Credential StealerJoe Security

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            18.2.InstallUtil.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              No Sigma rule has matched

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Found malware configurationShow sources
              Source: InstallUtil.exe.6348.18.memstrMalware Configuration Extractor: Agenttesla {"Username: ": "DaeBYCt", "URL: ": "https://R1cF2m25YjGPotRZ.org", "To: ": "tycoo2019@yandex.com", "ByHost: ": "smtp.yandex.com:587", "Password: ": "Tp5GwbbV4Cq", "From: ": "tycoo2019@yandex.com"}
              Multi AV Scanner detection for submitted fileShow sources
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exeVirustotal: Detection: 21%Perma Link
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exeReversingLabs: Detection: 10%
              Machine Learning detection for sampleShow sources
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exeJoe Sandbox ML: detected
              Source: 18.2.InstallUtil.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
              Source: global trafficTCP traffic: 192.168.2.4:49741 -> 77.88.21.158:587
              Source: Joe Sandbox ViewIP Address: 77.88.21.158 77.88.21.158
              Source: global trafficTCP traffic: 192.168.2.4:49741 -> 77.88.21.158:587
              Source: unknownDNS traffic detected: queries for: smtp.yandex.com
              Source: InstallUtil.exe, 00000012.00000002.467854650.0000000000402000.00000040.00000001.sdmpString found in binary or memory: http://127.0.0.1:
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ca.crl0h
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
              Source: InstallUtil.exe, 00000012.00000002.477899595.00000000068F0000.00000004.00000001.sdmpString found in binary or memory: http://crl.m
              Source: i.dll.0.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exe, 00000000.00000003.263543421.0000000005F72000.00000004.00000001.sdmpString found in binary or memory: http://ns.adobe.co
              Source: i.dll.0.drString found in binary or memory: http://ocsp.thawte.com0
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ca.cer09
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://repository.certum.pl/ycasha2.cer0
              Source: i.dll.0.drString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
              Source: i.dll.0.drString found in binary or memory: http://s2.symcb.com0
              Source: InstallUtil.exe, 00000012.00000002.472776715.0000000003270000.00000004.00000001.sdmpString found in binary or memory: http://smtp.yandex.com
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com0.
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
              Source: i.dll.0.drString found in binary or memory: http://sv.symcb.com/sv.crl0a
              Source: i.dll.0.drString found in binary or memory: http://sv.symcb.com/sv.crt0
              Source: i.dll.0.drString found in binary or memory: http://sv.symcd.com0&
              Source: i.dll.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
              Source: i.dll.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
              Source: i.dll.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://www.certum.pl/CPS0
              Source: i.dll.0.drString found in binary or memory: http://www.symauth.com/cps0(
              Source: i.dll.0.drString found in binary or memory: http://www.symauth.com/rpa00
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: http://yandex.ocsp-responder.com03
              Source: InstallUtil.exe, 00000012.00000002.471679841.0000000003150000.00000004.00000001.sdmpString found in binary or memory: https://R1cF2m25YjGPotRZ.org
              Source: InstallUtil.exe, 00000012.00000002.471679841.0000000003150000.00000004.00000001.sdmpString found in binary or memory: https://R1cF2m25YjGPotRZ.orgt
              Source: InstallUtil.exe, 00000012.00000002.467854650.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: i.dll.0.drString found in binary or memory: https://d.symcb.com/cps0%
              Source: i.dll.0.drString found in binary or memory: https://d.symcb.com/rpa0
              Source: InstallUtil.exe, 00000012.00000002.472916378.000000000327C000.00000004.00000001.sdmpString found in binary or memory: https://www.certum.pl/CPS0
              Source: InstallUtil.exe, 00000012.00000002.467854650.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: InstallUtil.exe, 00000012.00000002.467854650.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/U

              System Summary:

              barindex
              .NET source code contains very large array initializationsShow sources
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exe, ?u005b?09??u0029u002d1??8??u003d?3/u0038??u003f?u00282?u002a6??5??u007b?u002f1?u003a0??9??u005e?4u003d??u0024?.csLarge array initialization: 8?]??-?9:?2???=40??!?;6??: array initializer size 152576
              Source: 0.0.Encomenda Fornecedor n#U00ba 72718_____PDF.exe.190000.0.unpack, ?u005b?09??u0029u002d1??8??u003d?3/u0038??u003f?u00282?u002a6??5??u007b?u002f1?u003a0??9??u005e?4u003d??u0024?.csLarge array initialization: 8?]??-?9:?2???=40??!?;6??: array initializer size 152576
              Initial sample is a PE file and has a suspicious nameShow sources
              Source: initial sampleStatic PE information: Filename: Encomenda Fornecedor n#U00ba 72718_____PDF.exe
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_00DF20B018_2_00DF20B0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_0161A1D818_2_0161A1D8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_0161CA7018_2_0161CA70
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_0161AAA818_2_0161AAA8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_0161DC5818_2_0161DC58
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_01619E9018_2_01619E90
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_0161F0B818_2_0161F0B8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_0161F4A018_2_0161F4A0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_0161FA2818_2_0161FA28
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_0161FA3818_2_0161FA38
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_0161DC4818_2_0161DC48
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059C47F018_2_059C47F0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059C863418_2_059C8634
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059CCB0018_2_059CCB00
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059C4B3818_2_059C4B38
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059C7A2018_2_059C7A20
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059C47E118_2_059C47E1
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059C862818_2_059C8628
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059CC19418_2_059CC194
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059CC20818_2_059CC208
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059CBE1818_2_059CBE18
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059C793018_2_059C7930
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059C8B1418_2_059C8B14
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059C4B2918_2_059C4B29
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059CCAF118_2_059CCAF1
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AB6D018_2_066AB6D0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066ACCDD18_2_066ACCDD
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AF2A018_2_066AF2A0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A5B7818_2_066A5B78
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A7B1818_2_066A7B18
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A60E818_2_066A60E8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AC8D018_2_066AC8D0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A31D818_2_066A31D8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A51D818_2_066A51D8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A4EC818_2_066A4EC8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AB6C318_2_066AB6C3
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A4EB918_2_066A4EB9
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A074018_2_066A0740
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A075018_2_066A0750
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066ACFFD18_2_066ACFFD
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A346718_2_066A3467
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A750018_2_066A7500
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A751018_2_066A7510
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A6DE018_2_066A6DE0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A6DD018_2_066A6DD0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A5B6818_2_066A5B68
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066ADB6318_2_066ADB63
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A33E718_2_066A33E7
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A5BF918_2_066A5BF9
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AB06A18_2_066AB06A
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AC8C018_2_066AC8C0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A60D918_2_066A60D9
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A497018_2_066A4970
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AC94818_2_066AC948
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A491918_2_066A4919
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A51CB18_2_066A51CB
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AD1AD18_2_066AD1AD
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AA99018_2_066AA990
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\InstallUtil.exe 46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exe, 00000000.00000000.203193011.00000000001A8000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameABUTECHPARTTWO.exe\ vs Encomenda Fornecedor n#U00ba 72718_____PDF.exe
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exeBinary or memory string: OriginalFilenameABUTECHPARTTWO.exe\ vs Encomenda Fornecedor n#U00ba 72718_____PDF.exe
              Source: InstallUtil.exe, 00000012.00000002.477427190.0000000006700000.00000004.00000001.sdmpBinary or memory string: <.slN
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/3@2/1
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Encomenda Fornecedor n#U00ba 72718_____PDF.exe.logJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeFile created: C:\Users\user\AppData\Local\Temp\b1f92ac9-345d-4ee6-83d6-512dab76f3b9Jump to behavior
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exeVirustotal: Detection: 21%
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exeReversingLabs: Detection: 10%
              Source: unknownProcess created: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exe 'C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exe'
              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: Encomenda Fornecedor n#U00ba 72718_____PDF.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
              Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: InstallUtil.exe, 00000012.00000002.468609002.0000000000DF2000.00000002.00020000.sdmp, InstallUtil.exe.0.dr
              Source: Binary string: InstallUtil.pdb source: InstallUtil.exe, InstallUtil.exe.0.dr
              Source: Binary string: C:\Dropbox\Dev\ag.v66\Libraries\MSILJitter\bin\RELEASE\win32\AgileDotNetRT.pdb source: i.dll.0.dr
              Source: i.dll.0.drStatic PE information: section name: .didat
              Source: i.dll.0.drStatic PE information: section name: .00cfg
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_059CA437 push E8000000h; ret 18_2_059CA409
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A27A1 push 00000006h; iretd 18_2_066A27A8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AD5E8 push 8BFFFFFFh; iretd 18_2_066AD5F3
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066A6DAE push ss; ret 18_2_066A6DAF
              Source: initial sampleStatic PE information: section name: .text entropy: 7.47055763753
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeFile created: C:\Users\user\AppData\Local\Temp\b1f92ac9-345d-4ee6-83d6-512dab76f3b9\i.dllJump to dropped file
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeFile created: C:\Users\user\AppData\Local\Temp\InstallUtil.exeJump to dropped file
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect virtualization through RDTSC time measurementsShow sources
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeRDTSC instruction interceptor: First address: 000000006FFD1D36 second address: 000000006FFD2A87 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-10h], eax 0x00000005 mov dword ptr [ebp-0Ch], edx 0x00000008 mov eax, dword ptr [ebp-10h] 0x0000000b sub eax, dword ptr [ebp-08h] 0x0000000e mov edx, dword ptr [ebp-0Ch] 0x00000011 sbb edx, dword ptr [ebp-04h] 0x00000014 pop edi 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 mov esp, ebp 0x00000019 pop ebp 0x0000001a ret 0x0000001b mov dword ptr [6FFE53C0h], eax 0x00000020 mov dword ptr [6FFE53C4h], edx 0x00000026 mov dword ptr [ebp-0Ch], 00000000h 0x0000002d jmp 00007FDF408917EBh 0x0000002f mov eax, dword ptr [ebp-0Ch] 0x00000032 cmp eax, dword ptr [ebp+08h] 0x00000035 jnl 00007FDF40891826h 0x00000037 rdtsc
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeWindow / User API: threadDelayed 476Jump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exe TID: 6876Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exe TID: 6856Thread sleep count: 207 > 30Jump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exe TID: 6684Thread sleep count: 92 > 30Jump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exe TID: 6684Thread sleep count: 476 > 30Jump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exe TID: 6844Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1300Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1248Thread sleep count: 284 > 30Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1300Thread sleep time: -59188s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1300Thread sleep time: -58094s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1300Thread sleep time: -57188s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1300Thread sleep time: -39094s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1300Thread sleep time: -36406s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1300Thread sleep time: -36188s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1300Thread sleep time: -36000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 1300Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeLast function: Thread delayed
              Source: InstallUtil.exe, 00000012.00000002.477899595.00000000068F0000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlls
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_066AB430 LdrInitializeThunk,18_2_066AB430
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeMemory allocated: page read and write | page guardJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeProcess created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exeJump to behavior
              Source: InstallUtil.exe, 00000012.00000002.471433960.0000000001BA0000.00000002.00000001.sdmpBinary or memory string: Program Manager
              Source: InstallUtil.exe, 00000012.00000002.471433960.0000000001BA0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: InstallUtil.exe, 00000012.00000002.471433960.0000000001BA0000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: InstallUtil.exe, 00000012.00000002.471433960.0000000001BA0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeQueries volume information: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Users\user\AppData\Local\Temp\InstallUtil.exe VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 18_2_01618E64 GetUserNameW,18_2_01618E64
              Source: C:\Users\user\Desktop\Encomenda Fornecedor n#U00ba 72718_____PDF.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000012.00000002.467854650.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.471679841.0000000003150000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 6348, type: MEMORY
              Source: Yara matchFile source: 18.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
              Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
              Tries to harvest and steal browser information (history, passwords, etc)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Tries to harvest and steal ftp login credentialsShow sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\Jump to behavior
              Tries to steal Mail credentials (via file access)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: Yara matchFile source: 00000012.00000002.471679841.0000000003150000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 6348, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000012.00000002.467854650.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000012.00000002.471679841.0000000003150000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 6348, type: MEMORY
              Source: Yara matchFile source: 18.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid AccountsWindows Management Instrumentation211Path InterceptionProcess Injection12Masquerading1OS Credential Dumping2Security Software Discovery211Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsVirtualization/Sandbox Evasion13Credentials in Registry1Virtualization/Sandbox Evasion13Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothNon-Standard Port1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools1Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Local System2Automated ExfiltrationNon-Application Layer Protocol1Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection12NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferApplication Layer Protocol11SIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information2LSA SecretsAccount Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.commonSoftware Packing2Cached Domain CredentialsSystem Owner/User Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncRemote System Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Information Discovery214Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet