Loading ...

Play interactive tourEdit tour

Analysis Report PRODUCT LIST _IMG.exe

Overview

General Information

Sample Name:PRODUCT LIST _IMG.exe
Analysis ID:289647
MD5:9a28fb8644f6c9413772f5bb0d41e2f0
SHA1:bda74e1af9c7d634647fe4aacab9baf628f5a6bb
SHA256:bc7988fcd34bc5f8313b980f83197c4e9e41437097e8911e2744388ad026bd1a
Tags:exe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
.NET source code contains very large array initializations
Allocates memory in foreign processes
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect virtualization through RDTSC time measurements
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file access)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • PRODUCT LIST _IMG.exe (PID: 6480 cmdline: 'C:\Users\user\Desktop\PRODUCT LIST _IMG.exe' MD5: 9A28FB8644F6C9413772F5BB0D41E2F0)
    • RegAsm.exe (PID: 3128 cmdline: C:\Users\user\AppData\Local\Temp\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000003.512025324.0000000006995000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000000.00000003.511720075.0000000006994000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      0000000B.00000002.637339151.0000000000182000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        00000000.00000003.513888831.0000000006995000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000000.00000003.511687221.0000000006994000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 7 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            11.2.RegAsm.exe.180000.1.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              No Sigma rule has matched

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Antivirus / Scanner detection for submitted sampleShow sources
              Source: PRODUCT LIST _IMG.exeAvira: detected
              Multi AV Scanner detection for submitted fileShow sources
              Source: PRODUCT LIST _IMG.exeVirustotal: Detection: 33%Perma Link
              Source: PRODUCT LIST _IMG.exeReversingLabs: Detection: 22%
              Machine Learning detection for sampleShow sources
              Source: PRODUCT LIST _IMG.exeJoe Sandbox ML: detected
              Source: RegAsm.exe, 0000000B.00000002.638876591.0000000002381000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
              Source: RegAsm.exe, 0000000B.00000002.638876591.0000000002381000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
              Source: RegAsm.exe, 0000000B.00000002.638876591.0000000002381000.00000004.00000001.sdmpString found in binary or memory: http://VNgxdn.com
              Source: i.dll.0.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
              Source: PRODUCT LIST _IMG.exe, 00000000.00000003.428873431.00000000061B9000.00000004.00000001.sdmp, PRODUCT LIST _IMG.exe, 00000000.00000003.428941437.00000000061B9000.00000004.00000001.sdmpString found in binary or memory: http://ns.adobe.c
              Source: i.dll.0.drString found in binary or memory: http://ocsp.thawte.com0
              Source: i.dll.0.drString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
              Source: i.dll.0.drString found in binary or memory: http://s2.symcb.com0
              Source: i.dll.0.drString found in binary or memory: http://sv.symcb.com/sv.crl0a
              Source: i.dll.0.drString found in binary or memory: http://sv.symcb.com/sv.crt0
              Source: i.dll.0.drString found in binary or memory: http://sv.symcd.com0&
              Source: i.dll.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
              Source: i.dll.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
              Source: i.dll.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
              Source: i.dll.0.drString found in binary or memory: http://www.symauth.com/cps0(
              Source: i.dll.0.drString found in binary or memory: http://www.symauth.com/rpa00
              Source: RegAsm.exe, 0000000B.00000002.638876591.0000000002381000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
              Source: PRODUCT LIST _IMG.exe, 00000000.00000003.509049844.00000000062EB000.00000004.00000001.sdmpString found in binary or memory: https://api.telegra
              Source: RegAsm.exe, 0000000B.00000002.637339151.0000000000182000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot1322270726:AAE8ex2tDrvB9GA6y4VV0psQLtRL4yhRDdo/
              Source: RegAsm.exe, 0000000B.00000002.638876591.0000000002381000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot1322270726:AAE8ex2tDrvB9GA6y4VV0psQLtRL4yhRDdo/sendDocumentdocument-----
              Source: i.dll.0.drString found in binary or memory: https://d.symcb.com/cps0%
              Source: i.dll.0.drString found in binary or memory: https://d.symcb.com/rpa0
              Source: PRODUCT LIST _IMG.exe, 00000000.00000003.509049844.00000000062EB000.00000004.00000001.sdmp, RegAsm.exe, 0000000B.00000002.637339151.0000000000182000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: RegAsm.exe, 0000000B.00000002.638876591.0000000002381000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

              System Summary:

              barindex
              .NET source code contains very large array initializationsShow sources
              Source: PRODUCT LIST _IMG.exe, ??2u0028?4u003d???7u0040u007b3????/u0034??u002b?8u007c?u003c??57u005b???2?u002d6?u0040??.csLarge array initialization: ?,?70?=??:?5~?6: array initializer size 152576
              Source: 0.0.PRODUCT LIST _IMG.exe.460000.0.unpack, ??2u0028?4u003d???7u0040u007b3????/u0034??u002b?8u007c?u003c??57u005b???2?u002d6?u0040??.csLarge array initialization: ?,?70?=??:?5~?6: array initializer size 152576
              Source: 0.2.PRODUCT LIST _IMG.exe.460000.0.unpack, ??2u0028?4u003d???7u0040u007b3????/u0034??u002b?8u007c?u003c??57u005b???2?u002d6?u0040??.csLarge array initialization: ?,?70?=??:?5~?6: array initializer size 152576
              Initial sample is a PE file and has a suspicious nameShow sources
              Source: initial sampleStatic PE information: Filename: PRODUCT LIST _IMG.exe
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeCode function: 0_2_004662620_2_00466262
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeCode function: 0_2_004688250_2_00468825
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeCode function: 0_2_004685350_2_00468535
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeCode function: 0_2_004689350_2_00468935
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_000A3DFE11_2_000A3DFE
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_022246E011_2_022246E0
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_022235EC11_2_022235EC
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_022245EF11_2_022245EF
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_022253D011_2_022253D0
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_0222D1A011_2_0222D1A0
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_05B32EC011_2_05B32EC0
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_05B30B7811_2_05B30B78
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_05B3004011_2_05B30040
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_05B3BBF811_2_05B3BBF8
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\RegAsm.exe FFE4480CCC81B061F725C54587E9D1BA96547D27FE28083305D75796F2EB3E74
              Source: PRODUCT LIST _IMG.exe, 00000000.00000003.509049844.00000000062EB000.00000004.00000001.sdmpBinary or memory string: OriginalFilenamexaHKChGrfothPYhKLzQJlrwrpNjDFQhLzXzRsq.exe4 vs PRODUCT LIST _IMG.exe
              Source: PRODUCT LIST _IMG.exe, 00000000.00000003.506287450.00000000064F5000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameRegAsm.exeT vs PRODUCT LIST _IMG.exe
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeSection loaded: sfc.dllJump to behavior
              Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@3/3@0/0
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PRODUCT LIST _IMG.exe.logJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeFile created: C:\Users\user\AppData\Local\Temp\b1f92ac9-345d-4ee6-83d6-512dab76f3b9Jump to behavior
              Source: PRODUCT LIST _IMG.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: PRODUCT LIST _IMG.exeVirustotal: Detection: 33%
              Source: PRODUCT LIST _IMG.exeReversingLabs: Detection: 22%
              Source: unknownProcess created: C:\Users\user\Desktop\PRODUCT LIST _IMG.exe 'C:\Users\user\Desktop\PRODUCT LIST _IMG.exe'
              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: PRODUCT LIST _IMG.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: PRODUCT LIST _IMG.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
              Source: Binary string: RegAsm.pdb source: PRODUCT LIST _IMG.exe, 00000000.00000003.506287450.00000000064F5000.00000004.00000001.sdmp, RegAsm.exe, RegAsm.exe.0.dr
              Source: Binary string: RegAsm.pdb4 source: PRODUCT LIST _IMG.exe, 00000000.00000003.506287450.00000000064F5000.00000004.00000001.sdmp, RegAsm.exe, 0000000B.00000000.505091197.00000000000A2000.00000002.00020000.sdmp, RegAsm.exe.0.dr
              Source: Binary string: C:\Dropbox\Dev\ag.v66\Libraries\MSILJitter\bin\RELEASE\win32\AgileDotNetRT.pdb source: i.dll.0.dr
              Source: i.dll.0.drStatic PE information: section name: .didat
              Source: i.dll.0.drStatic PE information: section name: .00cfg
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeCode function: 0_2_00464144 push ss; retf 002Ah0_2_0046420A
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeCode function: 0_2_00463D72 push cs; retf 0_2_00463E57
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeCode function: 0_2_00462393 pushfd ; retf 0_2_00462397
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeCode function: 0_2_0046269D push esp; rep ret 0_2_004626ED
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_000A4289 push es; retf 11_2_000A4294
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_000A4469 push cs; retf 11_2_000A449E
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_000A44A3 push es; retf 11_2_000A44A4
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_05B37B26 push esp; iretd 11_2_05B37B25
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 11_2_05B37B19 push esp; iretd 11_2_05B37B25
              Source: initial sampleStatic PE information: section name: .text entropy: 7.38245937622
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeFile created: C:\Users\user\AppData\Local\Temp\b1f92ac9-345d-4ee6-83d6-512dab76f3b9\i.dllJump to dropped file
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeFile created: C:\Users\user\AppData\Local\Temp\RegAsm.exeJump to dropped file
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect virtualization through RDTSC time measurementsShow sources
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeRDTSC instruction interceptor: First address: 0000000073491D36 second address: 0000000073492A87 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-10h], eax 0x00000005 mov dword ptr [ebp-0Ch], edx 0x00000008 mov eax, dword ptr [ebp-10h] 0x0000000b sub eax, dword ptr [ebp-08h] 0x0000000e mov edx, dword ptr [ebp-0Ch] 0x00000011 sbb edx, dword ptr [ebp-04h] 0x00000014 pop edi 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 mov esp, ebp 0x00000019 pop ebp 0x0000001a ret 0x0000001b mov dword ptr [734A53C0h], eax 0x00000020 mov dword ptr [734A53C4h], edx 0x00000026 mov dword ptr [ebp-0Ch], 00000000h 0x0000002d jmp 00007FC270D882EBh 0x0000002f mov eax, dword ptr [ebp-0Ch] 0x00000032 cmp eax, dword ptr [ebp+08h] 0x00000035 jnl 00007FC270D88326h 0x00000037 rdtsc
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeWindow / User API: threadDelayed 428Jump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exe TID: 4824Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exe TID: 4996Thread sleep count: 189 > 30Jump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exe TID: 6900Thread sleep count: 129 > 30Jump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exe TID: 6900Thread sleep count: 428 > 30Jump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exe TID: 4768Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -2767011611056431s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 6976Thread sleep count: 226 > 30Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 6976Thread sleep count: 61 > 30Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -58186s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -52874s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -52686s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -51186s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -50686s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -49186s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -47686s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -47186s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -45686s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -44186s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -43686s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -34874s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -34686s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -31186s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4308Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeLast function: Thread delayed
              Source: RegAsm.exe, 0000000B.00000002.642185850.0000000005530000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: RegAsm.exe, 0000000B.00000002.642185850.0000000005530000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: RegAsm.exe, 0000000B.00000002.642185850.0000000005530000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: RegAsm.exe, 0000000B.00000002.642185850.0000000005530000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Allocates memory in foreign processesShow sources
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeMemory allocated: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 180000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeProcess created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exeJump to behavior
              Source: RegAsm.exe, 0000000B.00000002.638601902.0000000000CD0000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: RegAsm.exe, 0000000B.00000002.638601902.0000000000CD0000.00000002.00000001.sdmpBinary or memory string: NProgram Manager
              Source: RegAsm.exe, 0000000B.00000002.638601902.0000000000CD0000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: RegAsm.exe, 0000000B.00000002.638601902.0000000000CD0000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeQueries volume information: C:\Users\user\Desktop\PRODUCT LIST _IMG.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\RegAsm.exe VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\PRODUCT LIST _IMG.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000000.00000003.512025324.0000000006995000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.511720075.0000000006994000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.637339151.0000000000182000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.513888831.0000000006995000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.511687221.0000000006994000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.639005721.0000000002402000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.512281428.0000000006995000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.510897867.000000000698C000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.506497242.00000000062DD000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: PRODUCT LIST _IMG.exe PID: 6480, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3128, type: MEMORY
              Source: Yara matchFile source: 11.2.RegAsm.exe.180000.1.unpack, type: UNPACKEDPE
              Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)Show sources
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\SessionsJump to behavior
              Tries to harvest and steal browser information (history, passwords, etc)Show sources
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.iniJump to behavior
              Tries to harvest and steal ftp login credentialsShow sources
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xmlJump to behavior
              Tries to steal Mail credentials (via file access)Show sources
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeFile opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.iniJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeKey opened: HKEY_CURRENT_USER\Software\IncrediMail\IdentitiesJump to behavior
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3128, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000000.00000003.512025324.0000000006995000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.511720075.0000000006994000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.637339151.0000000000182000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.513888831.0000000006995000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.511687221.0000000006994000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.639005721.0000000002402000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.512281428.0000000006995000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.510897867.000000000698C000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.506497242.00000000062DD000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: PRODUCT LIST _IMG.exe PID: 6480, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 3128, type: MEMORY
              Source: Yara matchFile source: 11.2.RegAsm.exe.180000.1.unpack, type: UNPACKEDPE

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid AccountsWindows Management Instrumentation211DLL Side-Loading1Process Injection112Masquerading1OS Credential Dumping2Security Software Discovery211Remote ServicesEmail Collection1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsDLL Side-Loading1Virtualization/Sandbox Evasion13Credentials in Registry1Virtualization/Sandbox Evasion13Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Disable or Modify Tools1Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Local System2Automated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection112NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information2LSA SecretsSystem Information Discovery214SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.commonSoftware Packing1Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup ItemsDLL Side-Loading1DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.