Loading ...

Play interactive tourEdit tour

Analysis Report Delivery Details.exe

Overview

General Information

Sample Name:Delivery Details.exe
Analysis ID:299606
MD5:3b99a377018e690678102eb88e36e709
SHA1:84b159c7fdd522f912cdb2abab02f677f4f221d7
SHA256:3ef7d55a0de9ce092c357370dfc8efeddfa619f13a6ef4b70c40b3db01d2cdc5
Tags:AgentTeslaDHLexe

Most interesting Screenshot:

Detection

AgentTesla
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Icon mismatch, binary includes an icon from a different legit application in order to fool users
Multi AV Scanner detection for submitted file
Yara detected AgentTesla
.NET source code contains potential unpacker
.NET source code contains very large array initializations
Allocates memory in foreign processes
Binary contains a suspicious time stamp
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
PE file contains strange resources
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses a known web browser user agent for HTTP communication
Yara detected Credential Stealer

Classification

Startup

  • System is w10x64
  • Delivery Details.exe (PID: 6620 cmdline: 'C:\Users\user\Desktop\Delivery Details.exe' MD5: 3B99A377018E690678102EB88E36E709)
    • InstallUtil.exe (PID: 7008 cmdline: C:\Users\user\AppData\Local\Temp\InstallUtil.exe MD5: EFEC8C379D165E3F33B536739AEE26A3)
  • waffi.exe (PID: 5972 cmdline: 'C:\Users\user\AppData\Roaming\waffi\waffi.exe' MD5: EFEC8C379D165E3F33B536739AEE26A3)
    • conhost.exe (PID: 5588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • waffi.exe (PID: 6276 cmdline: 'C:\Users\user\AppData\Roaming\waffi\waffi.exe' MD5: EFEC8C379D165E3F33B536739AEE26A3)
    • conhost.exe (PID: 6296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
  • cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000003.810827396.0000000006A6F000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
    00000000.00000003.805241123.0000000006A43000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
      00000000.00000003.805628242.0000000006A46000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
        0000000B.00000002.916253196.0000000000402000.00000040.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
          00000000.00000003.810984752.00000000063B5000.00000004.00000001.sdmpJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security
            Click to see the 8 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            11.2.InstallUtil.exe.400000.0.unpackJoeSecurity_AgentTesla_1Yara detected AgentTeslaJoe Security

              Sigma Overview

              No Sigma rule has matched

              Signature Overview

              Click to jump to signature section

              Show All Signature Results

              AV Detection:

              barindex
              Multi AV Scanner detection for submitted fileShow sources
              Source: Delivery Details.exeReversingLabs: Detection: 37%
              Machine Learning detection for sampleShow sources
              Source: Delivery Details.exeJoe Sandbox ML: detected
              Source: 11.2.InstallUtil.exe.400000.0.unpackAvira: Label: TR/Spy.Gen8
              Source: global trafficHTTP traffic detected: POST /origin/inc/d20ee25f58c495.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: www.ccin29.comContent-Length: 362Expect: 100-continueConnection: Keep-Alive
              Source: unknownDNS traffic detected: queries for: www.ccin29.com
              Source: unknownHTTP traffic detected: POST /origin/inc/d20ee25f58c495.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: www.ccin29.comContent-Length: 362Expect: 100-continueConnection: Keep-Alive
              Source: InstallUtil.exe, 0000000B.00000002.921543924.0000000002F31000.00000004.00000001.sdmpString found in binary or memory: http://127.0.0.1:HTTP/1.1
              Source: InstallUtil.exe, 0000000B.00000002.921543924.0000000002F31000.00000004.00000001.sdmpString found in binary or memory: http://DynDns.comDynDNS
              Source: InstallUtil.exe, 0000000B.00000002.921543924.0000000002F31000.00000004.00000001.sdmpString found in binary or memory: http://ZbtYMB.com
              Source: InstallUtil.exe, 0000000B.00000002.921679724.0000000002FF6000.00000004.00000001.sdmpString found in binary or memory: http://ccin29.com
              Source: Delivery Details.exe, 00000000.00000003.804178077.00000000066B0000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
              Source: Delivery Details.exe, 00000000.00000003.804178077.00000000066B0000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: http://ocsp.thawte.com0
              Source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
              Source: Fdf.dll.0.drString found in binary or memory: http://s2.symcb.com0
              Source: InstallUtil.exe, 0000000B.00000002.921643994.0000000002FD8000.00000004.00000001.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: http://sv.symcb.com/sv.crl0a
              Source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: http://sv.symcb.com/sv.crt0
              Source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: http://sv.symcd.com0&
              Source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
              Source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
              Source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmpString found in binary or memory: http://ts-ocsp.ws.sy
              Source: Fdf.dll.0.drString found in binary or memory: http://ts-ocsp.ws.symantec.com07
              Source: InstallUtil.exe, 0000000B.00000002.921679724.0000000002FF6000.00000004.00000001.sdmpString found in binary or memory: http://www.ccin29.com
              Source: InstallUtil.exe, 0000000B.00000002.921643994.0000000002FD8000.00000004.00000001.sdmpString found in binary or memory: http://www.ccin29.com/origin/inc/d20ee25f58c495.php
              Source: InstallUtil.exe, 0000000B.00000002.921543924.0000000002F31000.00000004.00000001.sdmpString found in binary or memory: http://www.ccin29.com/origin/inc/d20ee25f58c495.php127.0.0.1POST
              Source: InstallUtil.exe, 0000000B.00000002.918668034.000000000135A000.00000004.00000020.sdmpString found in binary or memory: http://www.ccin29.com/origin/inc/d20ee25f58c495.phpE
              Source: InstallUtil.exe, 0000000B.00000002.921643994.0000000002FD8000.00000004.00000001.sdmpString found in binary or memory: http://www.ccin29.com4_k
              Source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: http://www.symauth.com/cps0(
              Source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: http://www.symauth.com/rpa00
              Source: InstallUtil.exe, 0000000B.00000002.921543924.0000000002F31000.00000004.00000001.sdmpString found in binary or memory: https://api.ipify.orgGETMozilla/5.0
              Source: Delivery Details.exe, 00000000.00000003.810827396.0000000006A6F000.00000004.00000001.sdmp, InstallUtil.exe, 0000000B.00000002.916253196.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/
              Source: InstallUtil.exe, 0000000B.00000002.921543924.0000000002F31000.00000004.00000001.sdmpString found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
              Source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmp, Fdf.dll.0.drString found in binary or memory: https://d.symcb.com/cps0%
              Source: Fdf.dll.0.drString found in binary or memory: https://d.symcb.com/rpa0
              Source: Delivery Details.exe, 00000000.00000003.810827396.0000000006A6F000.00000004.00000001.sdmp, InstallUtil.exe, 0000000B.00000002.916253196.0000000000402000.00000040.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
              Source: InstallUtil.exe, 0000000B.00000002.921543924.0000000002F31000.00000004.00000001.sdmpString found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

              System Summary:

              barindex
              .NET source code contains very large array initializationsShow sources
              Source: Delivery Details.exe, u0037ju002cmu002462hu002bu007b0g8wu0040vu007c9u005e4p1su002fz_/pu00407u00281m0x_su00293u002b8e2nu003axu00265u003d4mru002f69ju007du00233xxu007c.csLarge array initialization: 3e/r>16m:s&90y^v|4$7x5z{#8q2j,~6s: array initializer size 220176
              Source: 0.0.Delivery Details.exe.5b0000.0.unpack, u0037ju002cmu002462hu002bu007b0g8wu0040vu007c9u005e4p1su002fz_/pu00407u00281m0x_su00293u002b8e2nu003axu00265u003d4mru002f69ju007du00233xxu007c.csLarge array initialization: 3e/r>16m:s&90y^v|4$7x5z{#8q2j,~6s: array initializer size 220176
              Source: 11.2.InstallUtil.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b8FD34A9Au002d7703u002d46A2u002dB164u002d2AC70CDB4D9Eu007d/F3AC2E3Bu002d6F34u002d4452u002dA6C5u002d01A978B114C6.csLarge array initialization: .cctor: array initializer size 12026
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_00A820B011_2_00A820B0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_012546A011_2_012546A0
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_012535C411_2_012535C4
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_0125463011_2_01254630
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_0125469011_2_01254690
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_0125539011_2_01255390
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_0125D29011_2_0125D290
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_0615650811_2_06156508
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_061590D811_2_061590D8
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_0615712011_2_06157120
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_0615685011_2_06156850
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeCode function: 13_2_009E20B013_2_009E20B0
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeCode function: 13_2_02C707CC13_2_02C707CC
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeCode function: 15_2_00A120B015_2_00A120B0
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeCode function: 15_2_02DE07C815_2_02DE07C8
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\InstallUtil.exe 46DEE184523A584E56DF93389F81992911A1BA6B1F05AD7D803C6AB1450E18CB
              Source: Delivery Details.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: Delivery Details.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: Delivery Details.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
              Source: Delivery Details.exe, 00000000.00000003.810827396.0000000006A6F000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameJMtqGGcZhOHYpTYQCkEtGxAQWpZpFNQTEZSK.exe4 vs Delivery Details.exe
              Source: Delivery Details.exe, 00000000.00000003.804178077.00000000066B0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameInstallUtil.exeT vs Delivery Details.exe
              Source: Delivery Details.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: Delivery Details.exe, u0033nu007chu002a7u00280sxu003c5u00231q4zu002cu003a8mxu003b62xu003fu002b/u0038wu0025u00293x6xu003eu002a1smu005d9u00242v0xu003du002f7r.csCryptographic APIs: 'CreateDecryptor'
              Source: 0.0.Delivery Details.exe.5b0000.0.unpack, u0033nu007chu002a7u00280sxu003c5u00231q4zu002cu003a8mxu003b62xu003fu002b/u0038wu0025u00293x6xu003eu002a1smu005d9u00242v0xu003du002f7r.csCryptographic APIs: 'CreateDecryptor'
              Source: 11.2.InstallUtil.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: 11.2.InstallUtil.exe.400000.0.unpack, A/b2.csCryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
              Source: classification engineClassification label: mal100.troj.evad.winEXE@7/8@2/1
              Source: C:\Users\user\Desktop\Delivery Details.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Delivery Details.exe.logJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5588:120:WilError_01
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6296:120:WilError_01
              Source: C:\Users\user\Desktop\Delivery Details.exeFile created: C:\Users\user\AppData\Local\Temp\c7ebace9-d4f3-4576-b8fe-2fe996e42813Jump to behavior
              Source: Delivery Details.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
              Source: C:\Users\user\Desktop\Delivery Details.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\Desktop\Delivery Details.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
              Source: Delivery Details.exeReversingLabs: Detection: 37%
              Source: C:\Users\user\Desktop\Delivery Details.exeFile read: C:\Users\user\Desktop\Delivery Details.exe:Zone.IdentifierJump to behavior
              Source: unknownProcess created: C:\Users\user\Desktop\Delivery Details.exe 'C:\Users\user\Desktop\Delivery Details.exe'
              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exe
              Source: unknownProcess created: C:\Users\user\AppData\Roaming\waffi\waffi.exe 'C:\Users\user\AppData\Roaming\waffi\waffi.exe'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: unknownProcess created: C:\Users\user\AppData\Roaming\waffi\waffi.exe 'C:\Users\user\AppData\Roaming\waffi\waffi.exe'
              Source: unknownProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32Jump to behavior
              Source: Delivery Details.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: Delivery Details.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
              Source: Binary string: clrjit.pdb source: Delivery Details.exe, 00000000.00000003.804631590.00000000066C8000.00000004.00000001.sdmp
              Source: Binary string: InstallUtil.pdb\rvr hr_CorExeMainmscoree.dll source: Delivery Details.exe, 00000000.00000003.804178077.00000000066B0000.00000004.00000001.sdmp, InstallUtil.exe, 0000000B.00000000.802499388.0000000000A82000.00000002.00020000.sdmp, waffi.exe, 0000000D.00000000.886015008.00000000009E2000.00000002.00020000.sdmp, waffi.exe, 0000000F.00000000.903414888.0000000000A12000.00000002.00020000.sdmp, waffi.exe.11.dr
              Source: Binary string: InstallUtil.pdb source: waffi.exe, waffi.exe.11.dr
              Source: Binary string: C:\Dropbox\Dev\ag.v66\Libraries\MSILJitter\bin\RELEASE\win32\AgileDotNetRT.pdb source: Fdf.dll.0.dr

              Data Obfuscation:

              barindex
              .NET source code contains potential unpackerShow sources
              Source: Delivery Details.exe, mu002486pu002bu002c9wxu003c75xu007eu005e1x3su0023u0021/u0035zu002axu002c8u007e2s0xu005bxu003a3u00409szu00267u003c1m6j.cs.Net Code: .cctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Source: 0.0.Delivery Details.exe.5b0000.0.unpack, mu002486pu002bu002c9wxu003c75xu007eu005e1x3su0023u0021/u0035zu002axu002c8u007e2s0xu005bxu003a3u00409szu00267u003c1m6j.cs.Net Code: .cctor System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
              Binary contains a suspicious time stampShow sources
              Source: initial sampleStatic PE information: 0xF844A1C8 [Wed Dec 28 21:10:32 2101 UTC]
              Source: Fdf.dll.0.drStatic PE information: section name: .didat
              Source: Fdf.dll.0.drStatic PE information: section name: .00cfg
              Source: AgileDotNetRT.dll.0.drStatic PE information: section name: .didat
              Source: AgileDotNetRT.dll.0.drStatic PE information: section name: .00cfg
              Source: initial sampleStatic PE information: section name: .text entropy: 7.76274034219
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile created: C:\Users\user\AppData\Roaming\waffi\waffi.exeJump to dropped file
              Source: C:\Users\user\Desktop\Delivery Details.exeFile created: C:\Users\user\AppData\Local\Temp\c7ebace9-d4f3-4576-b8fe-2fe996e42813\Fdf.dllJump to dropped file
              Source: C:\Users\user\Desktop\Delivery Details.exeFile created: C:\Users\user\AppData\Local\Temp\InstallUtil.exeJump to dropped file
              Source: C:\Users\user\Desktop\Delivery Details.exeFile created: C:\Users\user\AppData\Local\Temp\b35bc50e-fc56-4239-a7d0-bb79118b31c9\AgileDotNetRT.dllJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run waffiJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeRegistry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run waffiJump to behavior

              Hooking and other Techniques for Hiding and Protection:

              barindex
              Icon mismatch, binary includes an icon from a different legit application in order to fool usersShow sources
              Source: initial sampleIcon embedded in binary file: icon matches a legit application icon: download (31).png
              Hides that the sample has been downloaded from the Internet (zone.identifier)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeFile opened: C:\Users\user\AppData\Roaming\waffi\waffi.exe:Zone.Identifier read attributes | deleteJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

              Malware Analysis System Evasion:

              barindex
              Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
              Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)Show sources
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
              Tries to detect virtualization through RDTSC time measurementsShow sources
              Source: C:\Users\user\Desktop\Delivery Details.exeRDTSC instruction interceptor: First address: 0000000072921D36 second address: 0000000072922A87 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-10h], eax 0x00000005 mov dword ptr [ebp-0Ch], edx 0x00000008 mov eax, dword ptr [ebp-10h] 0x0000000b sub eax, dword ptr [ebp-08h] 0x0000000e mov edx, dword ptr [ebp-0Ch] 0x00000011 sbb edx, dword ptr [ebp-04h] 0x00000014 pop edi 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 mov esp, ebp 0x00000019 pop ebp 0x0000001a ret 0x0000001b mov dword ptr [729353C0h], eax 0x00000020 mov dword ptr [729353C4h], edx 0x00000026 mov dword ptr [ebp-0Ch], 00000000h 0x0000002d jmp 00007F079D0E6D5Bh 0x0000002f mov eax, dword ptr [ebp-0Ch] 0x00000032 cmp eax, dword ptr [ebp+08h] 0x00000035 jnl 00007F079D0E6D96h 0x00000037 rdtsc
              Source: C:\Users\user\Desktop\Delivery Details.exeRDTSC instruction interceptor: First address: 0000000072922A97 second address: 0000000072922A87 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-08h], eax 0x00000005 mov dword ptr [ebp-04h], edx 0x00000008 mov eax, dword ptr [ebp-08h] 0x0000000b sub eax, dword ptr [ebp-14h] 0x0000000e mov ecx, dword ptr [ebp-04h] 0x00000011 sbb ecx, dword ptr [ebp-10h] 0x00000014 mov dword ptr [ebp-5Ch], eax 0x00000017 mov dword ptr [ebp-58h], ecx 0x0000001a mov edx, dword ptr [ebp-58h] 0x0000001d cmp edx, dword ptr [729353C4h] 0x00000023 jl 00007F079D0E31A5h 0x00000025 jnle 00007F079D0E31DDh 0x00000027 jmp 00007F079D0E317Dh 0x00000029 mov eax, dword ptr [ebp-0Ch] 0x0000002c add eax, 01h 0x0000002f mov dword ptr [ebp-0Ch], eax 0x00000032 mov eax, dword ptr [ebp-0Ch] 0x00000035 cmp eax, dword ptr [ebp+08h] 0x00000038 jnl 00007F079D0E3216h 0x0000003a rdtsc
              Source: C:\Users\user\Desktop\Delivery Details.exeRDTSC instruction interceptor: First address: 000000006F661D36 second address: 000000006F662A87 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-10h], eax 0x00000005 mov dword ptr [ebp-0Ch], edx 0x00000008 mov eax, dword ptr [ebp-10h] 0x0000000b sub eax, dword ptr [ebp-08h] 0x0000000e mov edx, dword ptr [ebp-0Ch] 0x00000011 sbb edx, dword ptr [ebp-04h] 0x00000014 pop edi 0x00000015 pop esi 0x00000016 pop ebx 0x00000017 mov esp, ebp 0x00000019 pop ebp 0x0000001a ret 0x0000001b mov dword ptr [6F6753C0h], eax 0x00000020 mov dword ptr [6F6753C4h], edx 0x00000026 mov dword ptr [ebp-0Ch], 00000000h 0x0000002d jmp 00007F079D0E6D5Bh 0x0000002f mov eax, dword ptr [ebp-0Ch] 0x00000032 cmp eax, dword ptr [ebp+08h] 0x00000035 jnl 00007F079D0E6D96h 0x00000037 rdtsc
              Source: C:\Users\user\Desktop\Delivery Details.exeRDTSC instruction interceptor: First address: 000000006F662A97 second address: 000000006F662A87 instructions: 0x00000000 rdtsc 0x00000002 mov dword ptr [ebp-08h], eax 0x00000005 mov dword ptr [ebp-04h], edx 0x00000008 mov eax, dword ptr [ebp-08h] 0x0000000b sub eax, dword ptr [ebp-14h] 0x0000000e mov ecx, dword ptr [ebp-04h] 0x00000011 sbb ecx, dword ptr [ebp-10h] 0x00000014 mov dword ptr [ebp-5Ch], eax 0x00000017 mov dword ptr [ebp-58h], ecx 0x0000001a mov edx, dword ptr [ebp-58h] 0x0000001d cmp edx, dword ptr [6F6753C4h] 0x00000023 jl 00007F079D0E31A5h 0x00000025 jnle 00007F079D0E31DDh 0x00000027 jmp 00007F079D0E317Dh 0x00000029 mov eax, dword ptr [ebp-0Ch] 0x0000002c add eax, 01h 0x0000002f mov dword ptr [ebp-0Ch], eax 0x00000032 mov eax, dword ptr [ebp-0Ch] 0x00000035 cmp eax, dword ptr [ebp+08h] 0x00000038 jnl 00007F079D0E3216h 0x0000003a rdtsc
              Source: C:\Users\user\Desktop\Delivery Details.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWindow / User API: threadDelayed 384Jump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exe TID: 3120Thread sleep time: -4611686018427385s >= -30000sJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exe TID: 1844Thread sleep count: 208 > 30Jump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exe TID: 4684Thread sleep count: 177 > 30Jump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exe TID: 4684Thread sleep count: 336 > 30Jump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exe TID: 864Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -2767011611056431s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5504Thread sleep count: 384 > 30Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -59500s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -59312s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -58718s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -58406s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -58218s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -58000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -57812s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -57594s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -57312s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -56718s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -56500s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -56218s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -55218s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -54906s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -54718s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exe TID: 5492Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exe TID: 4876Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exe TID: 6616Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeLast function: Thread delayed
              Source: InstallUtil.exe, 0000000B.00000002.923315932.0000000005E70000.00000002.00000001.sdmpBinary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
              Source: InstallUtil.exe, 0000000B.00000002.923315932.0000000005E70000.00000002.00000001.sdmpBinary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
              Source: InstallUtil.exe, 0000000B.00000002.923315932.0000000005E70000.00000002.00000001.sdmpBinary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
              Source: InstallUtil.exe, 0000000B.00000002.918668034.000000000135A000.00000004.00000020.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllB
              Source: InstallUtil.exe, 0000000B.00000002.923315932.0000000005E70000.00000002.00000001.sdmpBinary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion:

              barindex
              Allocates memory in foreign processesShow sources
              Source: C:\Users\user\Desktop\Delivery Details.exeMemory allocated: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000 protect: page execute and read and writeJump to behavior
              Injects a PE file into a foreign processesShow sources
              Source: C:\Users\user\Desktop\Delivery Details.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000 value starts with: 4D5AJump to behavior
              Writes to foreign memory regionsShow sources
              Source: C:\Users\user\Desktop\Delivery Details.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 400000Jump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 402000Jump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 438000Jump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: 43A000Jump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeMemory written: C:\Users\user\AppData\Local\Temp\InstallUtil.exe base: D5F008Jump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeProcess created: C:\Users\user\AppData\Local\Temp\InstallUtil.exe C:\Users\user\AppData\Local\Temp\InstallUtil.exeJump to behavior
              Source: InstallUtil.exe, 0000000B.00000002.921327297.0000000001960000.00000002.00000001.sdmpBinary or memory string: Program Manager
              Source: InstallUtil.exe, 0000000B.00000002.921327297.0000000001960000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
              Source: InstallUtil.exe, 0000000B.00000002.921327297.0000000001960000.00000002.00000001.sdmpBinary or memory string: Progman
              Source: InstallUtil.exe, 0000000B.00000002.921327297.0000000001960000.00000002.00000001.sdmpBinary or memory string: Progmanlock
              Source: C:\Users\user\Desktop\Delivery Details.exeQueries volume information: C:\Users\user\Desktop\Delivery Details.exe VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.Utilities.v4.0\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.v4.0.dll VolumeInformationJump to behavior
              Source: C:\Users\user\Desktop\Delivery Details.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Users\user\AppData\Local\Temp\InstallUtil.exe VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeQueries volume information: C:\Users\user\AppData\Roaming\waffi\waffi.exe VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeQueries volume information: C:\Users\user\AppData\Roaming\waffi\waffi.exe VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Roaming\waffi\waffi.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\InstallUtil.exeCode function: 11_2_0615223C GetUserNameW,11_2_0615223C
              Source: C:\Users\user\Desktop\Delivery Details.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Stealing of Sensitive Information:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000000.00000003.810827396.0000000006A6F000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.805241123.0000000006A43000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.805628242.0000000006A46000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.916253196.0000000000402000.00000040.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.810984752.00000000063B5000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.805569072.0000000006A46000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.806566849.0000000006A48000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.806738124.0000000006A59000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.921543924.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 7008, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: Delivery Details.exe PID: 6620, type: MEMORY
              Source: Yara matchFile source: 11.2.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0000000B.00000002.921543924.0000000002F31000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: InstallUtil.exe PID: 7008, type: MEMORY

              Remote Access Functionality:

              barindex
              Yara detected AgentTeslaShow sources
              Source: Yara matchFile source: 00000000.00000003.810827396.0000000006A6F000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.805241123.0000000006A43000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000000.00000003.805628242.0000000006A46000.00000004.00000001.sdmp, type: MEMORY
              Source: Yara matchFile source: 0000000B.00000002.916253196.0000000000402