Loading ...

Play interactive tourEdit tour

Analysis Report ARK $$$.exe

Overview

General Information

Sample Name:ARK $$$.exe
Analysis ID:289628
MD5:616ad46415b103a53a110f274ec30fca
SHA1:83ac61dc8b5851f7fe244bd1a4742c964175f99d
SHA256:ba2c2c908087e7de648b867b033564d6de3ca3fd459c2b6c6ab1d48f319e4057
Tags:exe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Detected unpacking (changes PE section rights)
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
Yara detected AntiVM_3
.NET source code contains very large array initializations
Allocates memory in foreign processes
Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)
Found evasive API chain (trying to detect sleep duration tampering with parallel thread)
Injects a PE file into a foreign processes
Machine Learning detection for sample
PE file contains section with special chars
PE file has nameless sections
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file access)
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to detect virtual machines (SLDT)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • ARK $$$.exe (PID: 6136 cmdline: 'C:\Users\user\Desktop\ARK $$$.exe' MD5: 616AD46415B103A53A110F274EC30FCA)
    • RegSvcs.exe (PID: 4612 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe MD5: 71369277D09DA0830C8C59F9E22BB23A)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.188942175.00000000064F0000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000001.00000002.437133835.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000000.00000002.185631222.00000000029C0000.00000004.00000001.sdmpJoeSecurity_AntiVM_3Yara detected AntiVM_3Joe Security
        00000001.00000002.439462524.0000000002B7C000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          Process Memory Space: RegSvcs.exe PID: 4612JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 2 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            1.2.RegSvcs.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              No Sigma rule has matched

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Multi AV Scanner detection for submitted fileShow sources
              Source: ARK $$$.exeVirustotal: Detection: 35%Perma Link
              Source: ARK $$$.exeReversingLabs: Detection: 35%
              Machine Learning detection for sampleShow sources
              Source: ARK $$$.exeJoe Sandbox ML: detected
              Source: 1.2.RegSvcs.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
              Source: RegSvcs.exe, 00000001.00000002.439283555.0000000002AD1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
              Source: RegSvcs.exe, 00000001.00000002.439283555.0000000002AD1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
              Source: RegSvcs.exe, 00000001.00000002.439283555.0000000002AD1000.00000004.00000001.sdmpString found in binary or memory: http://MPoNHG.com
              Source: RegSvcs.exe, 00000001.00000002.439283555.0000000002AD1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
              Source: RegSvcs.exe, 00000001.00000002.437133835.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: RegSvcs.exe, 00000001.00000002.439283555.0000000002AD1000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
              Source: RegSvcs.exe, 00000001.00000002.437133835.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: RegSvcs.exe, 00000001.00000002.439283555.0000000002AD1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

              System Summary:

              barindex
              .NET source code contains very large array initializationsShow sources
              Source: 1.2.RegSvcs.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b0AF84C64u002d1D1Au002d4444u002dA6ADu002dF1FBDAABFE5Eu007d/u00369BAAF3Au002dBD06u002d41E7u002dB771u002d33F02EC70A76.csLarge array initialization: .cctor: array initializer size 11829
              PE file contains section with special charsShow sources
              Source: ARK $$$.exeStatic PE information: section name: nHTPYh;:
              PE file has nameless sectionsShow sources
              Source: ARK $$$.exeStatic PE information: section name:
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_023DABEE NtQuerySystemInformation,0_2_023DABEE
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_023DABB3 NtQuerySystemInformation,0_2_023DABB3
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE60900_2_04AE6090
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AEC4F80_2_04AEC4F8
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE11B10_2_04AE11B1
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE1D880_2_04AE1D88
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AED9900_2_04AED990
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AEA5C00_2_04AEA5C0
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AEB1D00_2_04AEB1D0
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AEE5180_2_04AEE518
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE25410_2_04AE2541
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE2EC80_2_04AE2EC8
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AEDF500_2_04AEDF50
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE3CA00_2_04AE3CA0
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE5C880_2_04AE5C88
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE5C980_2_04AE5C98
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE94F00_2_04AE94F0
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE1CF10_2_04AE1CF1
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE29A80_2_04AE29A8
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AEF5900_2_04AEF590
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE01280_2_04AE0128
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE55310_2_04AE5531
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE55400_2_04AE5540
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE4AA00_2_04AE4AA0
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE5AB80_2_04AE5AB8
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE4A930_2_04AE4A93
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE9AE80_2_04AE9AE8
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE6AFD0_2_04AE6AFD
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE5AC80_2_04AE5AC8
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE5EC00_2_04AE5EC0
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE5ED00_2_04AE5ED0
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE12D00_2_04AE12D0
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AEBF080_2_04AEBF08
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_076CE3200_2_076CE320
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_076C00700_2_076C0070
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_076C5C3A0_2_076C5C3A
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_076C00070_2_076C0007
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_00E88AD01_2_00E88AD0
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_00E896501_2_00E89650
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_00E8CD881_2_00E8CD88
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_00E8D5481_2_00E8D548
              Source: ARK $$$.exeBinary or memory string: OriginalFilename vs ARK $$$.exe
              Source: ARK $$$.exe, 00000000.00000000.171634965.0000000000262000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameOXhN.exe@ vs ARK $$$.exe
              Source: ARK $$$.exe, 00000000.00000002.185649921.00000000029D4000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamehwAaIEwBCOphVybXeKYyUhoKHPqHDyMNhfDYw.exe4 vs ARK $$$.exe
              Source: ARK $$$.exe, 00000000.00000002.185689040.0000000002A1A000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameEminem.dll< vs ARK $$$.exe
              Source: ARK $$$.exe, 00000000.00000002.189598967.0000000007590000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameButterFly.dll< vs ARK $$$.exe
              Source: ARK $$$.exe, 00000000.00000002.189450457.0000000007270000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamemscorrc.dllT vs ARK $$$.exe
              Source: ARK $$$.exeBinary or memory string: OriginalFilenameOXhN.exe@ vs ARK $$$.exe
              Source: ARK $$$.exeStatic PE information: Section: nHTPYh;: ZLIB complexity 1.00032196323
              Source: 1.2.RegSvcs.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 1.2.RegSvcs.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/1@0/0
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_023DA592 AdjustTokenPrivileges,0_2_023DA592
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_023DA55B AdjustTokenPrivileges,0_2_023DA55B
              Source: C:\Users\user\Desktop\ARK $$$.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\ARK $$$.exe.logJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeMutant created: \Sessions\1\BaseNamedObjects\hiKjBywdGIVpUbtCI
              Source: C:\Users\user\Desktop\ARK $$$.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlpJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeSection loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlpJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\ARK $$$.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: ARK $$$.exeVirustotal: Detection: 35%
              Source: ARK $$$.exeReversingLabs: Detection: 35%
              Source: unknownProcess created: C:\Users\user\Desktop\ARK $$$.exe 'C:\Users\user\Desktop\ARK $$$.exe'
              Source: unknownProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeFile opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dllJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: ARK $$$.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: C:\Users\user\Desktop\ARK $$$.exeFile opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dllJump to behavior
              Source: ARK $$$.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
              Source: Binary string: mscorrc.pdb source: ARK $$$.exe, 00000000.00000002.189450457.0000000007270000.00000002.00000001.sdmp, RegSvcs.exe, 00000001.00000002.438111942.0000000000D30000.00000002.00000001.sdmp

              Data Obfuscation:

              barindex
              Detected unpacking (changes PE section rights)Show sources
              Source: C:\Users\user\Desktop\ARK $$$.exeUnpacked PE file: 0.2.ARK $$$.exe.260000.0.unpack nHTPYh;::EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;
              Source: ARK $$$.exeStatic PE information: section name: nHTPYh;:
              Source: ARK $$$.exeStatic PE information: section name:
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_002C606F pushfd ; ret 0_2_002C6070
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_002C6845 push ecx; iretd 0_2_002C6846
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_002C2047 push ds; ret 0_2_002C204F
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_023E4F2C push esp; ret 0_2_023E4F2D
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE7F1E push ds; ret 0_2_04AE7F22
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_04AE7F14 push ds; ret 0_2_04AE7F18
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_076C46EC push ds; ret 0_2_076C46ED
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_00E8BA40 pushfd ; ret 1_2_00E8BA85
              Source: initial sampleStatic PE information: section name: nHTPYh;: entropy: 7.99971311191
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Yara detected AntiVM_3Show sources
              Source: Yara matchFile source: 00000000.00000002.185631222.00000000029C0000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: ARK $$$.exe PID: 6136, type: MEMORY
              Found evasive API chain (trying to detect sleep duration tampering with parallel thread)Show sources
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFunction Chain: threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,systemQueried,threadDelayed
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFunction Chain: threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFunction Chain: threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFunction Chain: threadCreated,threadResumed,threadDelayed,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,systemQueried,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,threadDelayed,systemQueried,threadDelayed
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
              Source: ARK $$$.exe, 00000000.00000002.185631222.00000000029C0000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
              Source: ARK $$$.exe, 00000000.00000002.185631222.00000000029C0000.00000004.00000001.sdmpBinary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_002C153E sldt word ptr [eax]0_2_002C153E
              Source: C:\Users\user\Desktop\ARK $$$.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exe TID: 5632Thread sleep time: -54614s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exe TID: 4384Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeLast function: Thread delayed
              Source: ARK $$$.exe, 00000000.00000002.185631222.00000000029C0000.00000004.00000001.sdmpBinary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
              Source: RegSvcs.exe, 00000001.00000002.440770573.0000000005270000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: ARK $$$.exe, 00000000.00000002.185631222.00000000029C0000.00000004.00000001.sdmpBinary or memory string: vmware
              Source: RegSvcs.exe, 00000001.00000002.440770573.0000000005270000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: RegSvcs.exe, 00000001.00000002.440770573.0000000005270000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: ARK $$$.exe, 00000000.00000002.185631222.00000000029C0000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
              Source: ARK $$$.exe, 00000000.00000002.185631222.00000000029C0000.00000004.00000001.sdmpBinary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
              Source: RegSvcs.exe, 00000001.00000002.440770573.0000000005270000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess information queried: ProcessInformationJump to behavior

              Anti Debugging:

              barindex
              Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)Show sources
              Source: C:\Users\user\Desktop\ARK $$$.exeCode function: 0_2_023DA172 CheckRemoteDebuggerPresent,0_2_023DA172
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess queried: DebugPortJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess queried: DebugPortJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeCode function: 1_2_00E8EE70 LdrInitializeThunk,1_2_00E8EE70
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Allocates memory in foreign processesShow sources
              Source: C:\Users\user\Desktop\ARK $$$.exeMemory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000 protect: page execute and read and writeJump to behavior
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\ARK $$$.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000 value starts with: 4D5AJump to behavior
              Writes to foreign memory regionsShow sources
              Source: C:\Users\user\Desktop\ARK $$$.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 400000Jump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 402000Jump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 438000Jump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 43A000Jump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeMemory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe base: 70A008Jump to behavior
              Source: C:\Users\user\Desktop\ARK $$$.exeProcess created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeJump to behavior
              Source: RegSvcs.exe, 00000001.00000002.438615151.0000000001280000.00000002.00000001.sdmpBinary or memory string: Program Manager
              Source: RegSvcs.exe, 00000001.00000002.438615151.0000000001280000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: RegSvcs.exe, 00000001.00000002.438615151.0000000001280000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: RegSvcs.exe, 00000001.00000002.438615151.0000000001280000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeQueries volume information: C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000000.00000002.188942175.00000000064F0000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.437133835.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.439462524.0000000002B7C000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 4612, type: MEMORY
              Source: Yara matchFile source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
              Tries to harvest and steal browser information (history, passwords, etc)Show sources
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Tries to steal Mail credentials (via file access)Show sources
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
              Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 4612, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000000.00000002.188942175.00000000064F0000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.437133835.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000001.00000002.439462524.0000000002B7C000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: RegSvcs.exe PID: 4612, type: MEMORY
              Source: Yara matchFile source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid AccountsWindows Management Instrumentation211Path InterceptionAccess Token Manipulation1Masquerading1OS Credential Dumping1Security Software Discovery321Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Default AccountsNative API1Boot or Logon Initialization ScriptsProcess Injection312Virtualization/Sandbox Evasion15LSASS MemoryVirtualization/Sandbox Evasion15Remote Desktop ProtocolArchive Collected Data11Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools11Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Local System1Automated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Access Token Manipulation1NTDSSystem Information Discovery114Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptProcess Injection312LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.commonDeobfuscate/Decode Files or Information1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup ItemsObfuscated Files or Information2DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobSoftware Packing13Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.