Loading ...

Play interactive tourEdit tour

Analysis Report orden_de_compra_60011.img.exe

Overview

General Information

Sample Name:orden_de_compra_60011.img.exe
Analysis ID:299584
MD5:18c8f214397b9d5d154a8c7f56915446
SHA1:7e38e9cc7e25f302210b64e156bf3d85771ef412
SHA256:e17e57c83291e9ea8006511e2ac0a92d2a1d21b612b62f4ac2977f574b072234
Tags:AgentTeslaexe

Most interesting Screenshot:

Detection

AgentTesla
Score:88
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected AgentTesla
.NET source code contains very large array initializations
Allocates memory in foreign processes
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Contains capabilities to detect virtual machines
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Stores files to the Windows start menu directory
Tries to load missing DLLs
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • orden_de_compra_60011.img.exe (PID: 5716 cmdline: 'C:\Users\user\Desktop\orden_de_compra_60011.img.exe' MD5: 18C8F214397B9D5D154A8C7F56915446)
    • RegAsm.exe (PID: 5696 cmdline: C:\Users\user\AppData\Local\Temp\RegAsm.exe MD5: 6FD7592411112729BF6B1F2F6C34899F)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
      0000000D.00000002.900916328.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        Process Memory Space: RegAsm.exe PID: 5696JoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          Process Memory Space: RegAsm.exe PID: 5696JoeSecurity_CredentialStealerYara detected Credential StealerJoe Security

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            13.2.RegAsm.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              No Sigma rule has matched

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Multi AV Scanner detection for submitted fileShow sources
              Source: orden_de_compra_60011.img.exeReversingLabs: Detection: 14%
              Machine Learning detection for sampleShow sources
              Source: orden_de_compra_60011.img.exeJoe Sandbox ML: detected
              Source: 13.2.RegAsm.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
              Source: RegAsm.exe, 0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
              Source: RegAsm.exe, 0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
              Source: RegAsm.exe, 0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmpString found in binary or memory: http://PWjGSF.com
              Source: Fdf.dll.0.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
              Source: Fdf.dll.0.drString found in binary or memory: http://ocsp.thawte.com0
              Source: Fdf.dll.0.drString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
              Source: Fdf.dll.0.drString found in binary or memory: http://s2.symcb.com0
              Source: Fdf.dll.0.drString found in binary or memory: http://sv.symcb.com/sv.crl0a
              Source: Fdf.dll.0.drString found in binary or memory: http://sv.symcb.com/sv.crt0
              Source: Fdf.dll.0.drString found in binary or memory: http://sv.symcd.com0&
              Source: Fdf.dll.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
              Source: Fdf.dll.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
              Source: Fdf.dll.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
              Source: Fdf.dll.0.drString found in binary or memory: http://www.symauth.com/cps0(
              Source: Fdf.dll.0.drString found in binary or memory: http://www.symauth.com/rpa00
              Source: RegAsm.exe, 0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
              Source: RegAsm.exe, 0000000D.00000002.900916328.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: RegAsm.exe, 0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
              Source: Fdf.dll.0.drString found in binary or memory: https://d.symcb.com/cps0%
              Source: Fdf.dll.0.drString found in binary or memory: https://d.symcb.com/rpa0
              Source: RegAsm.exe, 0000000D.00000002.900916328.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: RegAsm.exe, 0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

              System Summary:

              barindex
              .NET source code contains very large array initializationsShow sources
              Source: orden_de_compra_60011.img.exe, u0034ku003du00243co_7u003e6e1au0026eu0028/zu002d7u00252n5cu003du005b9z1vu0021u00404m3lu003ehu002980cu005ddu002462gu003ai.csLarge array initialization: 0z$j~69y-;5ap,73c@: array initializer size 220176
              Source: 0.0.orden_de_compra_60011.img.exe.e70000.0.unpack, u0034ku003du00243co_7u003e6e1au0026eu0028/zu002d7u00252n5cu003du005b9z1vu0021u00404m3lu003ehu002980cu005ddu002462gu003ai.csLarge array initialization: 0z$j~69y-;5ap,73c@: array initializer size 220176
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 13_2_00F43DFE13_2_00F43DFE
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 13_2_031E46A013_2_031E46A0
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 13_2_031E35C413_2_031E35C4
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 13_2_031E45B013_2_031E45B0
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 13_2_031E539013_2_031E5390
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 13_2_031ED2E013_2_031ED2E0
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 13_2_031E35B813_2_031E35B8
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\RegAsm.exe FFE4480CCC81B061F725C54587E9D1BA96547D27FE28083305D75796F2EB3E74
              Source: orden_de_compra_60011.img.exe, 00000000.00000000.635283013.0000000000F5B000.00000002.00020000.sdmpBinary or memory string: OriginalFilename8077.exeH vs orden_de_compra_60011.img.exe
              Source: orden_de_compra_60011.img.exeBinary or memory string: OriginalFilename8077.exeH vs orden_de_compra_60011.img.exe
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeSection loaded: sfc.dllJump to behavior
              Source: orden_de_compra_60011.img.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: orden_de_compra_60011.img.exe, u0033zu007bcu002c1u002a0c4au0023u00292bm_98du007eu00216utu005e5u002d7k4n/u0031ju003fnu003d03tu005bu005d4c8ju0023u003b5z7iu0024_9ltu007b.csCryptographic APIs: 'CreateDecryptor'
              Source: 0.0.orden_de_compra_60011.img.exe.e70000.0.unpack, u0033zu007bcu002c1u002a0c4au0023u00292bm_98du007eu00216utu005e5u002d7k4n/u0031ju003fnu003d03tu005bu005d4c8ju0023u003b5z7iu0024_9ltu007b.csCryptographic APIs: 'CreateDecryptor'
              Source: classification engineClassification label: mal88.troj.evad.winEXE@3/6@0/0
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\01rde90000.jpgJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeFile created: C:\Users\user\AppData\Local\Temp\c7ebace9-d4f3-4576-b8fe-2fe996e42813Jump to behavior
              Source: orden_de_compra_60011.img.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: orden_de_compra_60011.img.exeReversingLabs: Detection: 14%
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeFile read: C:\Users\user\Desktop\orden_de_compra_60011.img.exe:Zone.IdentifierJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\orden_de_compra_60011.img.exe 'C:\Users\user\Desktop\orden_de_compra_60011.img.exe'
              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exe
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exeJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32Jump to behavior
              Source: orden_de_compra_60011.img.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: orden_de_compra_60011.img.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
              Source: Binary string: RegAsm.pdb source: RegAsm.exe, RegAsm.exe.0.dr
              Source: Binary string: RegAsm.pdb4 source: RegAsm.exe, 0000000D.00000002.900997289.0000000000F42000.00000002.00020000.sdmp, RegAsm.exe.0.dr
              Source: Binary string: C:\Dropbox\Dev\ag.v66\Libraries\MSILJitter\bin\RELEASE\win32\AgileDotNetRT.pdb source: Fdf.dll.0.dr
              Source: Fdf.dll.0.drStatic PE information: section name: .didat
              Source: Fdf.dll.0.drStatic PE information: section name: .00cfg
              Source: AgileDotNetRT.dll.0.drStatic PE information: section name: .didat
              Source: AgileDotNetRT.dll.0.drStatic PE information: section name: .00cfg
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 13_2_00F444A3 push es; retf 13_2_00F444A4
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 13_2_00F44469 push cs; retf 13_2_00F4449E
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeCode function: 13_2_00F44289 push es; retf 13_2_00F44294
              Source: initial sampleStatic PE information: section name: .text entropy: 7.70937283533
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeFile created: C:\Users\user\AppData\Local\Temp\RegAsm.exeJump to dropped file
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeFile created: C:\Users\user\AppData\Local\Temp\c7ebace9-d4f3-4576-b8fe-2fe996e42813\Fdf.dllJump to dropped file
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeFile created: C:\Users\user\AppData\Local\Temp\b35bc50e-fc56-4239-a7d0-bb79118b31c9\AgileDotNetRT.dllJump to dropped file
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\01rde90000.jpgJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect virtualization through RDTSC time measurementsShow sources
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeRDTSC instruction interceptor: First address: 000000006EED1D36 second address: 000000006EED2A87 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-10h], eax 0x00000005 mov dword ptr [ebp-0Ch], edx 0x00000008 mov eax, dword ptr [ebp-10h] 0x0000000b sub eax, dword ptr [ebp-08h] 0x0000000e mov edx, dword ptr [ebp-0Ch] 0x00000011 sbb edx, dword ptr [ebp-04h] 0x00000014 pop edi 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 mov esp, ebp 0x00000019 pop ebp 0x0000001a ret 0x0000001b mov dword ptr [6EEE53C0h], eax 0x00000020 mov dword ptr [6EEE53C4h], edx 0x00000026 mov dword ptr [ebp-0Ch], 00000000h 0x0000002d jmp 00007F0998C083EBh 0x0000002f mov eax, dword ptr [ebp-0Ch] 0x00000032 cmp eax, dword ptr [ebp+08h] 0x00000035 jnl 00007F0998C08426h 0x00000037 rdtsc
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeRDTSC instruction interceptor: First address: 000000006EED2A97 second address: 000000006EED2A87 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-08h], eax 0x00000005 mov dword ptr [ebp-04h], edx 0x00000008 mov eax, dword ptr [ebp-08h] 0x0000000b sub eax, dword ptr [ebp-14h] 0x0000000e mov ecx, dword ptr [ebp-04h] 0x00000011 sbb ecx, dword ptr [ebp-10h] 0x00000014 mov dword ptr [ebp-5Ch], eax 0x00000017 mov dword ptr [ebp-58h], ecx 0x0000001a mov edx, dword ptr [ebp-58h] 0x0000001d cmp edx, dword ptr [6EEE53C4h] 0x00000023 jl 00007F0998C02935h 0x00000025 jnle 00007F0998C0296Dh 0x00000027 jmp 00007F0998C0290Dh 0x00000029 mov eax, dword ptr [ebp-0Ch] 0x0000002c add eax, 01h 0x0000002f mov dword ptr [ebp-0Ch], eax 0x00000032 mov eax, dword ptr [ebp-0Ch] 0x00000035 cmp eax, dword ptr [ebp+08h] 0x00000038 jnl 00007F0998C029A6h 0x0000003a rdtsc
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeRDTSC instruction interceptor: First address: 000000006F461D36 second address: 000000006F462A87 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-10h], eax 0x00000005 mov dword ptr [ebp-0Ch], edx 0x00000008 mov eax, dword ptr [ebp-10h] 0x0000000b sub eax, dword ptr [ebp-08h] 0x0000000e mov edx, dword ptr [ebp-0Ch] 0x00000011 sbb edx, dword ptr [ebp-04h] 0x00000014 pop edi 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 mov esp, ebp 0x00000019 pop ebp 0x0000001a ret 0x0000001b mov dword ptr [6F4753C0h], eax 0x00000020 mov dword ptr [6F4753C4h], edx 0x00000026 mov dword ptr [ebp-0Ch], 00000000h 0x0000002d jmp 00007F0998C083EBh 0x0000002f mov eax, dword ptr [ebp-0Ch] 0x00000032 cmp eax, dword ptr [ebp+08h] 0x00000035 jnl 00007F0998C08426h 0x00000037 rdtsc
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeRDTSC instruction interceptor: First address: 000000006F462A97 second address: 000000006F462A87 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-08h], eax 0x00000005 mov dword ptr [ebp-04h], edx 0x00000008 mov eax, dword ptr [ebp-08h] 0x0000000b sub eax, dword ptr [ebp-14h] 0x0000000e mov ecx, dword ptr [ebp-04h] 0x00000011 sbb ecx, dword ptr [ebp-10h] 0x00000014 mov dword ptr [ebp-5Ch], eax 0x00000017 mov dword ptr [ebp-58h], ecx 0x0000001a mov edx, dword ptr [ebp-58h] 0x0000001d cmp edx, dword ptr [6F4753C4h] 0x00000023 jl 00007F0998C02935h 0x00000025 jnle 00007F0998C0296Dh 0x00000027 jmp 00007F0998C0290Dh 0x00000029 mov eax, dword ptr [ebp-0Ch] 0x0000002c add eax, 01h 0x0000002f mov dword ptr [ebp-0Ch], eax 0x00000032 mov eax, dword ptr [ebp-0Ch] 0x00000035 cmp eax, dword ptr [ebp+08h] 0x00000038 jnl 00007F0998C029A6h 0x0000003a rdtsc
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeWindow / User API: threadDelayed 398Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exe TID: 6908Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exe TID: 5144Thread sleep count: 262 > 30Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exe TID: 4540Thread sleep count: 82 > 30Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exe TID: 4540Thread sleep count: 330 > 30Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exe TID: 3492Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4972Thread sleep time: -2767011611056431s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 6508Thread sleep count: 398 > 30Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exe TID: 4972Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeLast function: Thread delayed
              Source: orden_de_compra_60011.img.exe, 00000000.00000003.734159486.000000000737A000.00000004.00000001.sdmpBinary or memory string: ('&4*)765:98EDCHGFSJIVUTYXWdcZgfejihutsxwv
              Source: RegAsm.exe, 0000000D.00000002.903884225.00000000063B0000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: orden_de_compra_60011.img.exe, 00000000.00000003.734159486.000000000737A000.00000004.00000001.sdmpBinary or memory string: ('&4*)765:98EDCHGFSJI
              Source: orden_de_compra_60011.img.exe, 00000000.00000003.731307341.0000000007333000.00000004.00000001.sdmpBinary or memory string: edchgfsjivutyxw
              Source: orden_de_compra_60011.img.exe, 00000000.00000003.731315148.000000000733B000.00000004.00000001.sdmpBinary or memory string: ('&5*)876C:9FEDIHGTSJWVUZYXedchgfsjivutyxw
              Source: RegAsm.exe, 0000000D.00000002.903884225.00000000063B0000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: RegAsm.exe, 0000000D.00000002.903884225.00000000063B0000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: orden_de_compra_60011.img.exe, 00000000.00000003.731307341.0000000007333000.00000004.00000001.sdmpBinary or memory string: %('&5*)876C:9FEDIHGTSJWVUZYXedchgfsjivutyxw
              Source: RegAsm.exe, 0000000D.00000002.903884225.00000000063B0000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Allocates memory in foreign processesShow sources
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeMemory allocated: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000 protect: page execute and read and writeJump to behavior
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeMemory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000 value starts with: 4D5AJump to behavior
              Writes to foreign memory regionsShow sources
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeMemory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 400000Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeMemory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 402000Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeMemory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 438000Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeMemory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 43A000Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeMemory written: C:\Users\user\AppData\Local\Temp\RegAsm.exe base: 106C008Jump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeProcess created: C:\Users\user\AppData\Local\Temp\RegAsm.exe C:\Users\user\AppData\Local\Temp\RegAsm.exeJump to behavior
              Source: RegAsm.exe, 0000000D.00000002.902027427.0000000001A80000.00000002.00000001.sdmpBinary or memory string: Program Manager
              Source: RegAsm.exe, 0000000D.00000002.902027427.0000000001A80000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: RegAsm.exe, 0000000D.00000002.902027427.0000000001A80000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: RegAsm.exe, 0000000D.00000002.902027427.0000000001A80000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeQueries volume information: C:\Users\user\Desktop\orden_de_compra_60011.img.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Users\user\AppData\Local\Temp\RegAsm.exe VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\RegAsm.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\orden_de_compra_60011.img.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.900916328.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5696, type: MEMORY
              Source: Yara matchFile source: 13.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5696, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 0000000D.00000002.902362106.00000000033A1000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000D.00000002.900916328.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: RegAsm.exe PID: 5696, type: MEMORY
              Source: Yara matchFile source: 13.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE

              Mitre Att&ck Matrix

              Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
              Valid AccountsWindows Management Instrumentation211Registry Run Keys / Startup Folder1Process Injection312Masquerading1OS Credential DumpingQuery Registry1Remote ServicesArchive Collected Data11Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
              Default AccountsScheduled Task/JobDLL Side-Loading1Registry Run Keys / Startup Folder1Virtualization/Sandbox Evasion14LSASS MemorySecurity Software Discovery221Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothJunk DataExploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
              Domain AccountsAt (Linux)Logon Script (Windows)DLL Side-Loading1Disable or Modify Tools1Security Account ManagerVirtualization/Sandbox Evasion14SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
              Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection312NTDSProcess Discovery2Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
              Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
              Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information2Cached Domain CredentialsFile and Directory Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
              External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing3DCSyncSystem Information Discovery213Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
              Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobDLL Side-Loading1Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

              Behavior Graph

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.