Play interactive tour

Edit tour

Analysis Report mcsrXx9lfD.exe

Overview

General Information

Sample Name:	mcsrXx9lfD.exe
Analysis ID:	321297
MD5:	3d549885e44863c57f59eab47f2271cc
SHA1:	76c51be921ef41ff2596f3f882b91c8ede3713c7
SHA256:	1d9c8ee9be6e0ee20b600c71989292aa2efd0849611389e3121bae364d9d6adf
Tags:	AgentTeslaexe
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Contains functionality to detect sleep reduction / modifications

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

mcsrXx9lfD.exe (PID: 7076 cmdline: 'C:\Users\user\Desktop\mcsrXx9lfD.exe' MD5: 3D549885E44863C57F59EAB47F2271CC)

mcsrXx9lfD.exe (PID: 7100 cmdline: 'C:\Users\user\Desktop\mcsrXx9lfD.exe' MD5: 3D549885E44863C57F59EAB47F2271CC)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "In9AcPpFuU", "URL: ": "http://Gwd19zMdFbudWhUhS.net", "To: ": "sales1@tzdieep.net", "ByHost: ": "smtp.tzdieep.net:587", "Password: ": "Ttlj1OTOO1N4A", "From: ": "sales1@tzdieep.net"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.680903753.000000000267B000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.680869571.0000000002632000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.946404123.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000001.679937947.000000000044B000.00000040.00020000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.946830924.0000000000792000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.680813500.00000000025E0000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.947178259.0000000000B22000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.946449899.000000000044B000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.946663757.0000000000630000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.948044914.00000000029B5000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.948310266.0000000002BC2000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: mcsrXx9lfD.exe PID: 7076	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: mcsrXx9lfD.exe PID: 7100	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: mcsrXx9lfD.exe PID: 7100	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.mcsrXx9lfD.exe.b20000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.mcsrXx9lfD.exe.630000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.mcsrXx9lfD.exe.630000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.mcsrXx9lfD.exe.25e0000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.mcsrXx9lfD.exe.25e0000.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.1.mcsrXx9lfD.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.mcsrXx9lfD.exe.2630000.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.mcsrXx9lfD.exe.790000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.mcsrXx9lfD.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 4 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: mcsrXx9lfD.exe.7100.1.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "In9AcPpFuU", "URL: ": "http://Gwd19zMdFbudWhUhS.net", "To: ": "sales1@tzdieep.net", "ByHost: ": "smtp.tzdieep.net:587", "Password: ": "Ttlj1OTOO1N4A", "From: ": "sales1@tzdieep.net"}

Multi AV Scanner detection for submitted file

Show sources

Source: mcsrXx9lfD.exe	Virustotal: Detection: 61%			Perma Link
Source: mcsrXx9lfD.exe	ReversingLabs: Detection: 79%

Machine Learning detection for sample

Show sources

Source: mcsrXx9lfD.exe

Joe Sandbox ML: detected

Source: 1.1.mcsrXx9lfD.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 1.2.mcsrXx9lfD.exe.b20000.4.unpack	Avira: Label: TR/Spy.Gen8

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00408938 FindFirstFileA,GetLastError,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00405AC0 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49766 -> 208.91.199.225:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.4:49767 -> 208.91.199.225:587

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: global traffic

TCP traffic: 192.168.2.4:49766 -> 208.91.199.225:587

Source: Joe Sandbox View	IP Address: 54.235.83.248 54.235.83.248
Source: Joe Sandbox View	IP Address: 54.235.83.248 54.235.83.248
Source: Joe Sandbox View	IP Address: 208.91.199.225 208.91.199.225

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

TCP traffic: 192.168.2.4:49766 -> 208.91.199.225:587

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: mcsrXx9lfD.exe, 00000001.00000002.948044914.00000000029B5000.00000004.00000001.sdmp, mcsrXx9lfD.exe, 00000001.00000002.948310266.0000000002BC2000.00000004.00000001.sdmp	String found in binary or memory: http://Gwd19zMdFbudWhUhS.net
Source: mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	String found in binary or memory: http://QBfyHm.com
Source: mcsrXx9lfD.exe, 00000001.00000003.902505301.00000000008EF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: mcsrXx9lfD.exe, 00000001.00000003.902505301.00000000008EF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0
Source: mcsrXx9lfD.exe, 00000001.00000003.902505301.00000000008EF000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: mcsrXx9lfD.exe, 00000001.00000002.948356194.0000000002C0D000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.tzdieep.net
Source: mcsrXx9lfD.exe, 00000001.00000002.948356194.0000000002C0D000.00000004.00000001.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org
Source: mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.org/
Source: mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: mcsrXx9lfD.exe, 00000000.00000002.680903753.000000000267B000.00000040.00000001.sdmp, mcsrXx9lfD.exe, 00000001.00000002.946404123.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/
Source: mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: mcsrXx9lfD.exe, 00000001.00000003.902505301.00000000008EF000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: mcsrXx9lfD.exe	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_0040703E OpenClipboard,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_0043258C GetClipboardData,GlobalFix,GlobalUnWire,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_0045BDA0 GetKeyboardState,SetKeyboardState,SendMessageA,SendMessageA,

Source: mcsrXx9lfD.exe, 00000000.00000002.680509638.000000000083A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Window created: window name: CLIPBRDWNDCLASS

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00457E74 NtdllDefWindowProc_A,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_004585F0 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_004586A0 IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0042E8BC NtdllDefWindowProc_A,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0044CA64 GetSubMenu,SaveDC,RestoreDC,72E7B080,SaveDC,RestoreDC,NtdllDefWindowProc_A,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0043CE20 NtdllDefWindowProc_A,GetCapture,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00444159 NtCreateSection,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00452548
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0044CA64
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00405808
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00402296
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_0040BD3D
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_0043D976
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_0044313D
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00788C78
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_0078CD70
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00785150
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00787508
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_007899B8
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00785598
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_0078F770
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00780388
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_0078CD6C
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_007855E0
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00AF40CE
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00AF7A28
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00AF2E78
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00AF98A1
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00AF09A0
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00AF8170
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00AFDFB8
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_04A646A0
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_04A645B0
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_04A6D301

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: String function: 00403980 appears 38 times
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: String function: 00404320 appears 79 times

Source: mcsrXx9lfD.exe, 00000000.00000002.680903753.000000000267B000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameZQtNfvtFGCsonuAQoHKxGPIofZqXzdgRHbUF.exe4 vs mcsrXx9lfD.exe
Source: mcsrXx9lfD.exe, 00000000.00000002.680456134.00000000007B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs mcsrXx9lfD.exe
Source: mcsrXx9lfD.exe	Binary or memory string: OriginalFilename vs mcsrXx9lfD.exe
Source: mcsrXx9lfD.exe, 00000001.00000002.946404123.0000000000402000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameZQtNfvtFGCsonuAQoHKxGPIofZqXzdgRHbUF.exe4 vs mcsrXx9lfD.exe
Source: mcsrXx9lfD.exe, 00000001.00000002.946352836.0000000000198000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs mcsrXx9lfD.exe
Source: mcsrXx9lfD.exe, 00000001.00000002.950384937.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs mcsrXx9lfD.exe
Source: mcsrXx9lfD.exe, 00000001.00000002.947135544.0000000000B00000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx.mui vs mcsrXx9lfD.exe
Source: mcsrXx9lfD.exe, 00000001.00000002.947103907.0000000000AE0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewshom.ocx vs mcsrXx9lfD.exe
Source: mcsrXx9lfD.exe, 00000001.00000002.946942776.0000000000820000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs mcsrXx9lfD.exe

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Section loaded: mscorwks.dll
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Section loaded: mscorsec.dll
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Section loaded: mscorjit.dll

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@4/2

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_00420594 GetLastError,FormatMessageA,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_00408B02 GetDiskFreeSpaceA,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_00416D64 FindResourceA,LoadResource,SizeofResource,LockResource,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

File created: C:\Users\user\AppData\Roaming\mmnabeka.1fc

Jump to behavior

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: mcsrXx9lfD.exe	Virustotal: Detection: 61%
Source: mcsrXx9lfD.exe	ReversingLabs: Detection: 79%

Source: unknown	Process created: C:\Users\user\Desktop\mcsrXx9lfD.exe 'C:\Users\user\Desktop\mcsrXx9lfD.exe'
Source: unknown	Process created: C:\Users\user\Desktop\mcsrXx9lfD.exe 'C:\Users\user\Desktop\mcsrXx9lfD.exe'
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process created: C:\Users\user\Desktop\mcsrXx9lfD.exe 'C:\Users\user\Desktop\mcsrXx9lfD.exe'

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Unpacked PE file: 1.2.mcsrXx9lfD.exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Unpacked PE file: 1.2.mcsrXx9lfD.exe.400000.0.unpack

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_00443C20 SetErrorMode,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetErrorMode,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00444250 push 004442DDh; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0040C020 push 0040C038h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0040C03A push 0040C0ABh; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0040C03C push 0040C0ABh; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00410150 push 004101B1h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0040C11A push 0040C148h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0040C11C push 0040C148h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0046C120 push 0046C153h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0046C1DC push 0046C208h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0045A1D8 push ecx; mov dword ptr [esp], edx
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_004281DC push 00428208h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_004441E8 push 0044424Eh; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00428190 push 004281D1h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_004101B4 push 004103B5h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00428214 push 0042824Ch; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0046C22C push 0046C26Fh; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0041C234 push ecx; mov dword ptr [esp], edx
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0046C2EC push 0046C318h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0046C294 push 0046C2D7h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00432364 push 004323BDh; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0046C324 push 0046C350h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_004263D8 push 004264A8h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_004103B8 push 004104FCh; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00412470 push eax; retf 0041h
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0041A4C8 push ecx; mov dword ptr [esp], edx
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_004104D0 push 004104FCh; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0047055C push 00470588h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00406576 push 004065C9h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00406578 push 004065C9h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00428538 push 00428564h; ret
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0042C5E4 push 0042C610h; ret

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00457EFC PostMessageA,PostMessageA,SendMessageA,GetProcAddress,GetLastError,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0043E4F4 IsIconic,GetCapture,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_004585F0 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_004586A0 IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00426BA4 IsIconic,GetWindowPlacement,GetWindowRect,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0043ED9C IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00454FF0 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_0043F680 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_0043372C

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Window / User API: threadDelayed 774

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_0043372C

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -89673s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 5968	Thread sleep count: 774 > 30
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -56782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -79923s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -50782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -48282s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -44782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -43282s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -41282s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -38282s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -56673s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -36282s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -34782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -51423s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -31282s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -40923s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -35673s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -30423s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -59594s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -59374s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -58688s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -58500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -57594s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -86061s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -57000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -84750s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -56094s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -55874s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -55188s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -55000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -54782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -53874s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -80532s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -80250s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -53000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -52782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -78891s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -52374s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -52000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -51688s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -77250s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -76923s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -51094s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -50874s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -50594s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -50188s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -75000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -49782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -49500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -49282s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -73641s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -73311s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -48688s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -48500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -48000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -47782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -47094s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -46874s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -46688s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -69750s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -45594s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -68061s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -45000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -44688s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -66750s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -44282s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -44094s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -43500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -42594s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -42374s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -41188s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -40500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -38000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -36688s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -36500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -35594s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -35374s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -34500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -33500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -33188s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -32094s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -31874s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -31000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -58000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -57782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -43188s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -43000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -42094s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -41874s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -41000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -40782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -39688s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -39500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -38594s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -38374s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -37500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -37282s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -36000s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -35094s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -34874s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -33782s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -32688s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -32500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -31594s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -31374s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -30500s >= -30000s
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe TID: 1476	Thread sleep time: -30282s >= -30000s

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_004703B0 GetSystemTime followed by cmp: cmp word ptr [esp], 07e4h and CTI: jnc 004703CBh

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00408938 FindFirstFileA,GetLastError,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 0_2_00405AC0 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_00420B24 GetSystemInfo,

Source: mcsrXx9lfD.exe, 00000001.00000002.950384937.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: mcsrXx9lfD.exe, 00000001.00000003.902505301.00000000008EF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllW
Source: mcsrXx9lfD.exe, 00000001.00000002.950384937.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: mcsrXx9lfD.exe, 00000001.00000002.950384937.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: mcsrXx9lfD.exe, 00000001.00000002.950384937.00000000056C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Process information queried: ProcessInformation

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process queried: DebugFlags
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Process queried: DebugObjectHandle

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 1_2_00AFE800 LdrInitializeThunk,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 1_2_0043F6F3 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00443412 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_004434D0 mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_0043F6F3 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_0043E746 SetUnhandledExceptionFilter,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_00441D7F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: 1_2_0043FBB5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Memory protected: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Section loaded: unknown target: C:\Users\user\Desktop\mcsrXx9lfD.exe protection: execute and read and write

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Process created: C:\Users\user\Desktop\mcsrXx9lfD.exe 'C:\Users\user\Desktop\mcsrXx9lfD.exe'

Source: mcsrXx9lfD.exe, 00000001.00000002.947333210.0000000000F80000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: mcsrXx9lfD.exe, 00000001.00000002.947333210.0000000000F80000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: mcsrXx9lfD.exe, 00000001.00000002.947333210.0000000000F80000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: mcsrXx9lfD.exe, 00000001.00000002.947333210.0000000000F80000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: GetLocaleInfoA,GetACP,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: GetLocaleInfoA,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: GetLocaleInfoA,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Code function: GetLocaleInfoA,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Queries volume information: C:\Users\user\Desktop\mcsrXx9lfD.exe VolumeInformation
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_004703B0 GetSystemTime,ExitProcess,6D8725A0,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Code function: 0_2_00444250 GetVersion,

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.680903753.000000000267B000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.680869571.0000000002632000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.946404123.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.679937947.000000000044B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.946830924.0000000000792000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.680813500.00000000025E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.947178259.0000000000B22000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.946449899.000000000044B000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.946663757.0000000000630000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.948310266.0000000002BC2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mcsrXx9lfD.exe PID: 7076, type: MEMORY
Source: Yara match	File source: Process Memory Space: mcsrXx9lfD.exe PID: 7100, type: MEMORY
Source: Yara match	File source: 1.2.mcsrXx9lfD.exe.b20000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.mcsrXx9lfD.exe.630000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.mcsrXx9lfD.exe.630000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mcsrXx9lfD.exe.25e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mcsrXx9lfD.exe.25e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.mcsrXx9lfD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mcsrXx9lfD.exe.2630000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.mcsrXx9lfD.exe.790000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.mcsrXx9lfD.exe.400000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\Desktop\mcsrXx9lfD.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 00000001.00000002.948044914.00000000029B5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mcsrXx9lfD.exe PID: 7100, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000000.00000002.680903753.000000000267B000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.680869571.0000000002632000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.946404123.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.679937947.000000000044B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.946830924.0000000000792000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.680813500.00000000025E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.947178259.0000000000B22000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.946449899.000000000044B000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.946663757.0000000000630000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.948310266.0000000002BC2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mcsrXx9lfD.exe PID: 7076, type: MEMORY
Source: Yara match	File source: Process Memory Space: mcsrXx9lfD.exe PID: 7100, type: MEMORY
Source: Yara match	File source: 1.2.mcsrXx9lfD.exe.b20000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.mcsrXx9lfD.exe.630000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.mcsrXx9lfD.exe.630000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mcsrXx9lfD.exe.25e0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mcsrXx9lfD.exe.25e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.mcsrXx9lfD.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mcsrXx9lfD.exe.2630000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.mcsrXx9lfD.exe.790000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.mcsrXx9lfD.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping2	System Time Discovery11	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information1	Input Capture21	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection112	Obfuscated Files or Information2	Credentials in Registry1	System Information Discovery128	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing21	NTDS	Query Registry1	Distributed Component Object Model	Input Capture21	Scheduled Transfer	Application Layer Protocol12	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Security Software Discovery251	SSH	Clipboard Data3	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading1	Cached Domain Credentials	Virtualization/Sandbox Evasion14	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion14	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection112	Proc Filesystem	Application Window Discovery11	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Network Configuration Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mcsrXx9lfD.exe	61%	Virustotal		Browse
mcsrXx9lfD.exe	79%	ReversingLabs	Win32.Trojan.LokiBot
mcsrXx9lfD.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.2.mcsrXx9lfD.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1138205	Download File
0.2.mcsrXx9lfD.exe.25e0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.1.mcsrXx9lfD.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
0.2.mcsrXx9lfD.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131223	Download File
0.2.mcsrXx9lfD.exe.2630000.3.unpack	100%	Avira	HEUR/AGEN.1138205	Download File
1.2.mcsrXx9lfD.exe.790000.2.unpack	100%	Avira	HEUR/AGEN.1138205	Download File
1.2.mcsrXx9lfD.exe.b20000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://smtp.tzdieep.net	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://QBfyHm.com	0%	Avira URL Cloud	safe
http://Gwd19zMdFbudWhUhS.net	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
elb097307-934924932.us-east-1.elb.amazonaws.com	54.235.83.248	true	false	high
us2.smtp.mailhostbox.com	208.91.199.225	true	false	high
smtp.tzdieep.net	unknown	unknown	true	unknown
api.ipify.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	false		high
http://127.0.0.1:HTTP/1.1	mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://api.ipify.org	mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	false		high
http://DynDns.comDynDNS	mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://smtp.tzdieep.net	mcsrXx9lfD.exe, 00000001.00000002.948356194.0000000002C0D000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://us2.smtp.mailhostbox.com	mcsrXx9lfD.exe, 00000001.00000002.948356194.0000000002C0D000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.telegram.org/bot%telegramapi%/	mcsrXx9lfD.exe, 00000000.00000002.680903753.000000000267B000.00000040.00000001.sdmp, mcsrXx9lfD.exe, 00000001.00000002.946404123.0000000000402000.00000040.00000001.sdmp	false		high
http://QBfyHm.com	mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	false		high
https://secure.comodo.com/CPS0	mcsrXx9lfD.exe, 00000001.00000003.902505301.00000000008EF000.00000004.00000001.sdmp	false		high
http://Gwd19zMdFbudWhUhS.net	mcsrXx9lfD.exe, 00000001.00000002.948044914.00000000029B5000.00000004.00000001.sdmp, mcsrXx9lfD.exe, 00000001.00000002.948310266.0000000002BC2000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x	mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	mcsrXx9lfD.exe	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.ipify.orgGETMozilla/5.0	mcsrXx9lfD.exe, 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
54.235.83.248	unknown	United States		14618	AMAZON-AESUS	false
208.91.199.225	unknown	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	321297
Start date:	20.11.2020
Start time:	20:03:26
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 18s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	mcsrXx9lfD.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@4/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 15.4% (good quality ratio 15.1%) Quality average: 80.2% Quality standard deviation: 22.1%
HCA Information:	Successful, ratio: 88% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.139.144, 13.88.21.125, 168.61.161.212, 51.104.139.180, 52.155.217.156, 20.54.26.129, 51.132.208.181, 92.122.213.194, 92.122.213.247 Excluded domains from analysis (whitelisted): displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, arc.msn.com.nsatc.net, db3p-ris-pf-prod-atm.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, skypedataprdcolcus16.cloudapp.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, umwatsonrouting.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, skypedataprdcolwus15.cloudapp.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:04:42	API Interceptor	863x Sleep call for process: mcsrXx9lfD.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54.235.83.248	BUILDING ORDER_PROPERTY SPECS.exe	Get hash	malicious	Browse	api.ipify.org/
	OOLU2115890120.xls.exe	Get hash	malicious	Browse	api.ipify.org/
	OBJEDNAT- SII40513967MM793333.PDF.exe	Get hash	malicious	Browse	api.ipify.org/
	5dj4XCE86M.exe	Get hash	malicious	Browse	api.ipify.org/
	di0xAdpLSs.exe	Get hash	malicious	Browse	api.ipify.org/
	payload.exe	Get hash	malicious	Browse	api.ipify.org/
	TNT_Consignment#Ref08971375.gz.exe	Get hash	malicious	Browse	api.ipify.org/
	Our Purchase Order.exe	Get hash	malicious	Browse	api.ipify.org/
	PO-40, PO-41 & PO-42.exe	Get hash	malicious	Browse	api.ipify.org/
	DHL EXPRESS - AWB Numero 06785388011- CONSEGNA DI SPEDIZIONE ORIGINALE.exe	Get hash	malicious	Browse	api.ipify.org/
	vlc-3.0.3-win64.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	Haruko Industrial Supply Tents.exe	Get hash	malicious	Browse	api.ipify.org/
	VlkInw3QXN.exe	Get hash	malicious	Browse	api.ipify.org/
	8sDk3xbzN5.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	uqJ2lweGkV.exe	Get hash	malicious	Browse	api.ipify.org/?format=xml
	JdZVwprs2g.exe	Get hash	malicious	Browse	api.ipify.org/
	SA765754789654677898367ORDER.exe	Get hash	malicious	Browse	api.ipify.org/
	p.exe	Get hash	malicious	Browse	api.ipify.org/
	Purchase Order_pdf.exe	Get hash	malicious	Browse	api.ipify.org/
	chibyke09.exe	Get hash	malicious	Browse	api.ipify.org/
208.91.199.225	Shipping Details_PDF.exe	Get hash	malicious	Browse
	Order List.xlsx	Get hash	malicious	Browse
	me4qssWAMQ.exe	Get hash	malicious	Browse
	WireTransfer Copy767.exe	Get hash	malicious	Browse
	INQUIRY ON PRICE LIST.xlsm	Get hash	malicious	Browse
	ptv12s0TtX.exe	Get hash	malicious	Browse
	PO 8276789.exe	Get hash	malicious	Browse
	Shipping Details.exe	Get hash	malicious	Browse
	Payment Reference.exe	Get hash	malicious	Browse
	RFQ HLG 21565 HLG SLB ENI MGS BGCS 3 5 RFQ PROJECT OPEN QUOTE HLG 2140 PSI OCT Rev 0 201.exe	Get hash	malicious	Browse
	zH170byIQo.exe	Get hash	malicious	Browse
	2Y3bYDsJgq.exe	Get hash	malicious	Browse
	6SoZZ8R0y4.exe	Get hash	malicious	Browse
	iKmlkmiQfn.exe	Get hash	malicious	Browse
	FINAL SHIPPING DOCS.exe	Get hash	malicious	Browse
	jyqw5vanyZ.exe	Get hash	malicious	Browse
	sDOgBZ59qb.exe	Get hash	malicious	Browse
	P.O. #HBG00356.doc.exe	Get hash	malicious	Browse
	wnF0nE0YUI.exe	Get hash	malicious	Browse
	AWB-145670003.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
us2.smtp.mailhostbox.com	Bill # 2.xlsx	Get hash	malicious	Browse	208.91.198.143
	PO1.xlsx	Get hash	malicious	Browse	208.91.199.223
	QKLQkaCe9M.exe	Get hash	malicious	Browse	208.91.199.224
	0hgHwEkIWY.exe	Get hash	malicious	Browse	208.91.198.143
	Swift Copy.exe	Get hash	malicious	Browse	208.91.199.224
	Shipping Details_PDF.exe	Get hash	malicious	Browse	208.91.199.225
	RFQ_SMKM19112020.xlsx	Get hash	malicious	Browse	208.91.199.224
	Order List.xlsx	Get hash	malicious	Browse	208.91.199.225
	Shipping doc.pdf.exe	Get hash	malicious	Browse	208.91.198.143
	OrV86zxFWHW1j0f.exe	Get hash	malicious	Browse	208.91.199.224
	XDMBhLJxD1Qf7JW.exe	Get hash	malicious	Browse	208.91.199.224
	me4qssWAMQ.exe	Get hash	malicious	Browse	208.91.199.225
	Vd58qg0dhp.exe	Get hash	malicious	Browse	208.91.199.223
	15egpuWfT3.exe	Get hash	malicious	Browse	208.91.199.224
	Shipping Details.exe	Get hash	malicious	Browse	208.91.198.143
	Wrong Transfer Payment - Chk Clip Copy.exe	Get hash	malicious	Browse	208.91.199.223
	WireTransfer Copy767.exe	Get hash	malicious	Browse	208.91.199.225
	DOH0003675550.pdf.exe	Get hash	malicious	Browse	208.91.199.224
	aviso de remesas_pdf__________________________________________.exe	Get hash	malicious	Browse	208.91.199.224
	Doc.exe	Get hash	malicious	Browse	208.91.199.223
elb097307-934924932.us-east-1.elb.amazonaws.com	SecuriteInfo.com.Trojan.PackedNET.461.20928.exe	Get hash	malicious	Browse	23.21.42.25
	Defender-update-kit-x86x64.exe	Get hash	malicious	Browse	54.225.153.147
	https://largemail.r1.rpost.net/files/7xU97qcFgCvB3Uv1wDC4qvS2ZriLfublohKWA5V3/ln/en-us	Get hash	malicious	Browse	54.225.66.103
	ORDER.exe	Get hash	malicious	Browse	54.235.142.93
	Bill # 2.xlsx	Get hash	malicious	Browse	23.21.42.25
	PO1.xlsx	Get hash	malicious	Browse	174.129.214.20
	a7UZzCVWKO.exe	Get hash	malicious	Browse	54.204.14.42
	QKLQkaCe9M.exe	Get hash	malicious	Browse	50.19.252.36
	sAPuJAvs52.exe	Get hash	malicious	Browse	54.243.161.145
	JlgyVmPWZr.exe	Get hash	malicious	Browse	174.129.214.20
	EIUOzWW2JX.exe	Get hash	malicious	Browse	174.129.214.20
	RVAgYSH2qh.exe	Get hash	malicious	Browse	54.235.142.93
	yCyc4rN0u8.exe	Get hash	malicious	Browse	54.235.83.248
	9cXAnovmQX.exe	Get hash	malicious	Browse	54.225.66.103
	T2HDck1Mmy.exe	Get hash	malicious	Browse	54.235.142.93
	Purchase Order.exe	Get hash	malicious	Browse	54.225.66.103
	Payment Advice Note from 19.11.2020.exe	Get hash	malicious	Browse	23.21.126.66
	phy__1__31629__2649094674__1605642612.exe	Get hash	malicious	Browse	23.21.126.66
	BBVA confirming Aviso de pago Eur5780201120.exe	Get hash	malicious	Browse	54.204.14.42
	Ejgvvuwuu8.exe	Get hash	malicious	Browse	54.225.169.28

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-AESUS	SecuriteInfo.com.Trojan.PackedNET.461.20928.exe	Get hash	malicious	Browse	23.21.42.25
	Defender-update-kit-x86x64.exe	Get hash	malicious	Browse	54.225.153.147
	https://largemail.r1.rpost.net/files/7xU97qcFgCvB3Uv1wDC4qvS2ZriLfublohKWA5V3/ln/en-us	Get hash	malicious	Browse	54.225.66.103
	ORDER.exe	Get hash	malicious	Browse	54.235.142.93
	http://s1022.t.en25.com/e/er?s=1022&lid=2184&elqTrackId=BEDFF87609C7D9DEAD041308DD8FFFB8&lb_email=bkirwer%40farbestfoods.com&elq=b095bd096fb54161953a2cf8316b5d13&elqaid=3115&elqat=1	Get hash	malicious	Browse	52.1.99.77
	Bill # 2.xlsx	Get hash	malicious	Browse	23.21.42.25
	https://ubereats.app.link/cwmLFZfMz5?%243p=a_custom_354088&%24deeplink_path=promo%2Fapply%3FpromoCode%3DRECONFORT7&%24desktop_url=tracking.spectrumemp.com/el?aid=8feeb968-bdd0-11e8-b27f-22000be0a14e&rid=50048635&pid=285843&cid=513&dest=overlordscan.com/cmV0by5tZXR6bGVyQGlzb2x1dGlvbnMuY2g=%23#kkowfocjoyuynaip#	Get hash	malicious	Browse	35.170.181.205
	BANK ACCOUNT INFO!.exe	Get hash	malicious	Browse	107.22.223.163
	PO1.xlsx	Get hash	malicious	Browse	174.129.214.20
	https://rebrand.ly/zkp0y	Get hash	malicious	Browse	54.227.164.140
	AccountStatements.html	Get hash	malicious	Browse	18.209.113.162
	a7UZzCVWKO.exe	Get hash	malicious	Browse	54.204.14.42
	QKLQkaCe9M.exe	Get hash	malicious	Browse	50.19.252.36
	sAPuJAvs52.exe	Get hash	malicious	Browse	54.243.161.145
	JlgyVmPWZr.exe	Get hash	malicious	Browse	174.129.214.20
	EIUOzWW2JX.exe	Get hash	malicious	Browse	174.129.214.20
	RVAgYSH2qh.exe	Get hash	malicious	Browse	54.235.142.93
	yCyc4rN0u8.exe	Get hash	malicious	Browse	54.235.83.248
	9cXAnovmQX.exe	Get hash	malicious	Browse	54.225.66.103
	T2HDck1Mmy.exe	Get hash	malicious	Browse	54.235.142.93
PUBLIC-DOMAIN-REGISTRYUS	fattura.exe	Get hash	malicious	Browse	162.222.226.70
	Pagamento.exe	Get hash	malicious	Browse	162.222.226.70
	PO1.xlsx	Get hash	malicious	Browse	208.91.199.223
	QKLQkaCe9M.exe	Get hash	malicious	Browse	208.91.199.224
	Zahlung.exe	Get hash	malicious	Browse	162.222.226.70
	0hgHwEkIWY.exe	Get hash	malicious	Browse	208.91.198.143
	Swift Copy.exe	Get hash	malicious	Browse	208.91.199.224
	Shipping Details_PDF.exe	Get hash	malicious	Browse	208.91.199.225
	Zahlung.exe	Get hash	malicious	Browse	162.222.226.70
	Lieferadresse.exe	Get hash	malicious	Browse	162.222.226.70
	RFQ_SMKM19112020.xlsx	Get hash	malicious	Browse	208.91.199.224
	Order List.xlsx	Get hash	malicious	Browse	208.91.199.225
	Shipping doc.pdf.exe	Get hash	malicious	Browse	208.91.198.143
	OrV86zxFWHW1j0f.exe	Get hash	malicious	Browse	208.91.199.224
	XDMBhLJxD1Qf7JW.exe	Get hash	malicious	Browse	208.91.199.224
	me4qssWAMQ.exe	Get hash	malicious	Browse	208.91.199.225
	Vd58qg0dhp.exe	Get hash	malicious	Browse	208.91.199.223
	15egpuWfT3.exe	Get hash	malicious	Browse	208.91.199.224
	PO_287104.exe	Get hash	malicious	Browse	208.91.198.225
	Machine drawing.exe	Get hash	malicious	Browse	199.79.63.24

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Trojan.PackedNET.461.20928.exe	Get hash	malicious	Browse	54.235.83.248
	ARjQJiNmBs.exe	Get hash	malicious	Browse	54.235.83.248
	1piS4PBvBp.exe	Get hash	malicious	Browse	54.235.83.248
	ORDER.exe	Get hash	malicious	Browse	54.235.83.248
	a7UZzCVWKO.exe	Get hash	malicious	Browse	54.235.83.248
	QKLQkaCe9M.exe	Get hash	malicious	Browse	54.235.83.248
	sAPuJAvs52.exe	Get hash	malicious	Browse	54.235.83.248
	JlgyVmPWZr.exe	Get hash	malicious	Browse	54.235.83.248
	EIUOzWW2JX.exe	Get hash	malicious	Browse	54.235.83.248
	yCyc4rN0u8.exe	Get hash	malicious	Browse	54.235.83.248
	9cXAnovmQX.exe	Get hash	malicious	Browse	54.235.83.248
	T2HDck1Mmy.exe	Get hash	malicious	Browse	54.235.83.248
	Payment Advice Note from 19.11.2020.exe	Get hash	malicious	Browse	54.235.83.248
	PO N0.1500243224._PDF.exe	Get hash	malicious	Browse	54.235.83.248
	zRHI9DJ0YKIPfBX.exe	Get hash	malicious	Browse	54.235.83.248
	chib(1).exe	Get hash	malicious	Browse	54.235.83.248
	dede.exe	Get hash	malicious	Browse	54.235.83.248
	obi(1).exe	Get hash	malicious	Browse	54.235.83.248
	frc(1).exe	Get hash	malicious	Browse	54.235.83.248
	knitted yarn documents.exe	Get hash	malicious	Browse	54.235.83.248

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Roaming\mmnabeka.1fc\Chrome\Default\Cookies Download File
Process:	C:\Users\user\Desktop\mcsrXx9lfD.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7006690334145785
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBoe9H6pf1H1oNQ:T5LLOpEO5J/Kn7U1uBobfvoNQ
MD5:	A7FE10DA330AD03BF22DC9AC76BBB3E4
SHA1:	1805CB7A2208BAEFF71DCB3FE32DB0CC935CF803
SHA-256:	8D6B84A96429B5C672838BF431A47EC59655E561EBFBB4E63B46351D10A7AAD8
SHA-512:	1DBE27AED6E1E98E9F82AC1F5B774ACB6F3A773BEB17B66C2FB7B89D12AC87A6D5B716EF844678A5417F30EE8855224A8686A135876AB4C0561B3C6059E635C7
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.87101358003814
TrID:	Win32 Executable (generic) a (10002005/4) 99.24% InstallShield setup (43055/19) 0.43% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	mcsrXx9lfD.exe
File size:	945664
MD5:	3d549885e44863c57f59eab47f2271cc
SHA1:	76c51be921ef41ff2596f3f882b91c8ede3713c7
SHA256:	1d9c8ee9be6e0ee20b600c71989292aa2efd0849611389e3121bae364d9d6adf
SHA512:	60d415743a8212cfc649ed20670d2ee4dff060cbf93475a7bc5f8d273bbbed5e472fb9d5ea055fa126d6986b250ca3203894b0454e6162fbd14e2dceeca40fc9
SSDEEP:	24576:j6j4rvrKwang6WCxVA0d6yxE6iw2lKK0D/YNN:92wa5xB62ElJubYNN
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	6861f0969ee86882

Static PE Info

General
Entrypoint:	0x4707f8
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f19034443dbba8ae65cae64d05fef57a

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00470608h
call 00007F1990EA8A01h
mov eax, dword ptr [0048E6ECh]
mov eax, dword ptr [eax]
call 00007F1990EFAE65h
mov ecx, dword ptr [0048E7D8h]
mov eax, dword ptr [0048E6ECh]
mov eax, dword ptr [eax]
mov edx, dword ptr [004700F4h]
call 00007F1990EFAE65h
mov eax, dword ptr [0048E6ECh]
mov eax, dword ptr [eax]
call 00007F1990EFAED9h
call 00007F1990EA64F8h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x90000	0x247a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9d000	0x4f5f4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x95000	0x77c8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x94000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x6f840	0x6fa00	False	0.523629969205	data	6.51435589822	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
DATA	0x71000	0x1d868	0x1da00	False	0.161260548523	data	2.59870276116	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
BSS	0x8f000	0xcc1	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x90000	0x247a	0x2600	False	0.349403782895	data	4.92563231128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x93000	0x10	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x94000	0x18	0x200	False	0.05078125	data	0.206920017787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x95000	0x77c8	0x7800	False	0.582259114583	data	6.64226915187	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x9d000	0x4f5f4	0x4f600	False	0.908793676181	data	7.56970916741	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x9db0c	0x134	data
RT_CURSOR	0x9dc40	0x134	data
RT_CURSOR	0x9dd74	0x134	data
RT_CURSOR	0x9dea8	0x134	data
RT_CURSOR	0x9dfdc	0x134	data
RT_CURSOR	0x9e110	0x134	data
RT_CURSOR	0x9e244	0x134	data
RT_BITMAP	0x9e378	0x1d0	data
RT_BITMAP	0x9e548	0x1e4	data
RT_BITMAP	0x9e72c	0x1d0	data
RT_BITMAP	0x9e8fc	0x1d0	data
RT_BITMAP	0x9eacc	0x1d0	data
RT_BITMAP	0x9ec9c	0x1d0	data
RT_BITMAP	0x9ee6c	0x1d0	data
RT_BITMAP	0x9f03c	0x1d0	data
RT_BITMAP	0x9f20c	0x49d04	data	English	United States
RT_BITMAP	0xe8f10	0x1d0	data
RT_BITMAP	0xe90e0	0xd8	data
RT_BITMAP	0xe91b8	0xd8	data
RT_BITMAP	0xe9290	0xd8	data
RT_BITMAP	0xe9368	0xd8	data
RT_BITMAP	0xe9440	0xd8	data
RT_ICON	0xe9518	0x1e8	data	English	United States
RT_STRING	0xe9700	0x1c4	data
RT_STRING	0xe98c4	0x210	data
RT_STRING	0xe9ad4	0xec	data
RT_STRING	0xe9bc0	0x24c	data
RT_STRING	0xe9e0c	0x140	data
RT_STRING	0xe9f4c	0x4c0	data
RT_STRING	0xea40c	0x378	data
RT_STRING	0xea784	0x378	data
RT_STRING	0xeaafc	0x418	data
RT_STRING	0xeaf14	0xf4	data
RT_STRING	0xeb008	0xc4	data
RT_STRING	0xeb0cc	0x2e0	data
RT_STRING	0xeb3ac	0x35c	data
RT_STRING	0xeb708	0x2b4	data
RT_RCDATA	0xeb9bc	0x10	data
RT_RCDATA	0xeb9cc	0x290	data
RT_RCDATA	0xebc5c	0x85d	Delphi compiled form 'TForm1'
RT_GROUP_CURSOR	0xec4bc	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xec4d0	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xec4e4	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xec4f8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xec50c	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xec520	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xec534	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0xec548	0x14	data	English	United States
RT_HTML	0xec55c	0x98	data	English	United States

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtectEx, VirtualProtect, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetTempPathA, GetSystemTime, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExitProcess, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWindowExtEx, SetWinMetaFileBits, SetViewportOrgEx, SetViewportExtEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetMapMode, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PolyPolyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExtCreatePen, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
opengl32.dll	wglDeleteContext
user32.dll	WindowFromPoint, WinHelpA, WaitMessage, ValidateRect, UpdateWindow, UnregisterClassA, UnionRect, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetMenuItemInfoA, SetMenu, SetKeyboardState, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindowEx, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, IsCharAlphaNumericA, IsCharAlphaA, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessageTime, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDoubleClickTime, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCaretPos, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumClipboardFormats, EndPaint, EndDeferWindowPos, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DeferWindowPos, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreateWindowExA, CreatePopupMenu, CreateMenu, CreateIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, BeginDeferWindowPos, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayRedim, SafeArrayCreate, VariantChangeTypeEx, VariantCopyInd, VariantCopy, VariantClear, VariantInit
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
kernel32.dll	MulDiv
kernel32.dll	AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
11/20/20-20:06:14.054607	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49766	587	192.168.2.4	208.91.199.225
11/20/20-20:06:19.529008	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49767	587	192.168.2.4	208.91.199.225

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2020 20:06:02.867763042 CET	49765	443	192.168.2.4	54.235.83.248
Nov 20, 2020 20:06:02.970710039 CET	443	49765	54.235.83.248	192.168.2.4
Nov 20, 2020 20:06:02.970840931 CET	49765	443	192.168.2.4	54.235.83.248
Nov 20, 2020 20:06:03.048233032 CET	49765	443	192.168.2.4	54.235.83.248
Nov 20, 2020 20:06:03.151184082 CET	443	49765	54.235.83.248	192.168.2.4
Nov 20, 2020 20:06:03.151365995 CET	443	49765	54.235.83.248	192.168.2.4
Nov 20, 2020 20:06:03.151412010 CET	443	49765	54.235.83.248	192.168.2.4
Nov 20, 2020 20:06:03.151449919 CET	443	49765	54.235.83.248	192.168.2.4
Nov 20, 2020 20:06:03.151488066 CET	443	49765	54.235.83.248	192.168.2.4
Nov 20, 2020 20:06:03.151523113 CET	49765	443	192.168.2.4	54.235.83.248
Nov 20, 2020 20:06:03.151604891 CET	49765	443	192.168.2.4	54.235.83.248
Nov 20, 2020 20:06:03.152462959 CET	443	49765	54.235.83.248	192.168.2.4
Nov 20, 2020 20:06:03.193653107 CET	49765	443	192.168.2.4	54.235.83.248
Nov 20, 2020 20:06:03.296808958 CET	443	49765	54.235.83.248	192.168.2.4
Nov 20, 2020 20:06:03.337061882 CET	49765	443	192.168.2.4	54.235.83.248
Nov 20, 2020 20:06:03.527725935 CET	49765	443	192.168.2.4	54.235.83.248
Nov 20, 2020 20:06:03.650266886 CET	443	49765	54.235.83.248	192.168.2.4
Nov 20, 2020 20:06:03.696402073 CET	49765	443	192.168.2.4	54.235.83.248
Nov 20, 2020 20:06:12.046245098 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:12.195732117 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:12.195873022 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:12.812896967 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:12.813532114 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:12.963042974 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:12.963083982 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:12.965086937 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:13.117259979 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:13.118549109 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:13.272712946 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:13.273732901 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:13.426875114 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:13.427592993 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:13.587024927 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:13.587740898 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:13.900435925 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:13.970786095 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:13.970876932 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:14.052644968 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:14.054606915 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:14.054723978 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:14.054792881 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:14.054862022 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:14.206177950 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:14.206207037 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:14.304539919 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:14.353532076 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:15.132817984 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:15.285135031 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:15.285177946 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:15.285315037 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:15.285629988 CET	49766	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:15.287194967 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:15.437752962 CET	587	49766	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:18.291451931 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:18.443504095 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:18.443722963 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:18.597949028 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:18.598503113 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:18.750886917 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:18.750929117 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:18.751543045 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:18.905124903 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:18.905966997 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.059966087 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:19.060359955 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.213042021 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:19.213613987 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.372828960 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:19.373275995 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.526504993 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:19.528677940 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.529007912 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.529237986 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.529467106 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.529825926 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.530020952 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.530205011 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.530380964 CET	49767	587	192.168.2.4	208.91.199.225
Nov 20, 2020 20:06:19.682955027 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:19.683171988 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:19.683890104 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:19.683937073 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:19.723391056 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:19.782569885 CET	587	49767	208.91.199.225	192.168.2.4
Nov 20, 2020 20:06:19.822771072 CET	49767	587	192.168.2.4	208.91.199.225

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2020 20:04:25.524873972 CET	62389	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:25.551821947 CET	53	62389	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:26.320063114 CET	49910	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:26.346997976 CET	53	49910	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:27.294008017 CET	55854	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:27.321191072 CET	53	55854	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:28.159040928 CET	64549	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:28.194726944 CET	53	64549	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:29.805763960 CET	63153	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:29.832993984 CET	53	63153	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:30.656399012 CET	52991	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:30.683475018 CET	53	52991	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:31.821947098 CET	53700	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:31.848968029 CET	53	53700	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:33.008469105 CET	51726	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:33.035512924 CET	53	51726	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:33.855465889 CET	56794	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:33.885452986 CET	53	56794	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:34.672504902 CET	56534	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:34.699506998 CET	53	56534	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:35.485847950 CET	56627	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:36.471452951 CET	56627	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:37.468499899 CET	53	56627	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:37.468878031 CET	53	56627	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:38.335410118 CET	56621	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:38.371105909 CET	53	56621	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:39.222748995 CET	63116	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:39.249989986 CET	53	63116	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:48.703561068 CET	64078	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:48.730670929 CET	53	64078	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:56.614922047 CET	64801	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:56.650635958 CET	53	64801	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:57.426611900 CET	61721	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:57.462377071 CET	53	61721	8.8.8.8	192.168.2.4
Nov 20, 2020 20:04:58.906955004 CET	51255	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:04:58.934135914 CET	53	51255	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:05.601068020 CET	61522	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:05.638362885 CET	53	61522	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:06.045974970 CET	52337	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:06.188076019 CET	53	52337	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:06.658164024 CET	55046	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:06.694003105 CET	53	55046	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:07.053534031 CET	49612	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:07.091173887 CET	53	49612	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:07.443414927 CET	49285	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:07.479268074 CET	53	49285	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:07.865032911 CET	50601	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:07.885739088 CET	60875	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:07.900911093 CET	53	50601	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:07.912983894 CET	53	60875	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:08.316250086 CET	56448	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:08.351902962 CET	53	56448	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:08.967999935 CET	59172	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:09.004004955 CET	53	59172	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:09.666666985 CET	62420	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:09.693757057 CET	53	62420	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:10.107448101 CET	60579	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:10.145284891 CET	53	60579	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:24.209593058 CET	50183	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:24.236658096 CET	53	50183	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:24.264631033 CET	61531	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:24.300369024 CET	53	61531	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:27.762192965 CET	49228	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:27.799884081 CET	53	49228	8.8.8.8	192.168.2.4
Nov 20, 2020 20:05:59.897576094 CET	59794	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:05:59.926115036 CET	53	59794	8.8.8.8	192.168.2.4
Nov 20, 2020 20:06:01.692032099 CET	55916	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:06:01.719229937 CET	53	55916	8.8.8.8	192.168.2.4
Nov 20, 2020 20:06:02.679915905 CET	52752	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:06:02.715765953 CET	53	52752	8.8.8.8	192.168.2.4
Nov 20, 2020 20:06:02.738959074 CET	60542	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:06:02.766254902 CET	53	60542	8.8.8.8	192.168.2.4
Nov 20, 2020 20:06:11.700295925 CET	60689	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:06:11.864727974 CET	53	60689	8.8.8.8	192.168.2.4
Nov 20, 2020 20:06:11.878782034 CET	64206	53	192.168.2.4	8.8.8.8
Nov 20, 2020 20:06:12.043437004 CET	53	64206	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 20, 2020 20:06:02.679915905 CET	192.168.2.4	8.8.8.8	0x390f	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.738959074 CET	192.168.2.4	8.8.8.8	0xd2a2	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:11.700295925 CET	192.168.2.4	8.8.8.8	0x6c4	Standard query (0)	smtp.tzdieep.net	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:11.878782034 CET	192.168.2.4	8.8.8.8	0xa6f5	Standard query (0)	smtp.tzdieep.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 20, 2020 20:06:02.715765953 CET	8.8.8.8	192.168.2.4	0x390f	No error (0)	api.ipify.org	nagano-19599.herokussl.com		CNAME (Canonical name)	IN (0x0001)
Nov 20, 2020 20:06:02.715765953 CET	8.8.8.8	192.168.2.4	0x390f	No error (0)	nagano-19599.herokussl.com	elb097307-934924932.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Nov 20, 2020 20:06:02.715765953 CET	8.8.8.8	192.168.2.4	0x390f	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.83.248	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.715765953 CET	8.8.8.8	192.168.2.4	0x390f	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		174.129.214.20	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.715765953 CET	8.8.8.8	192.168.2.4	0x390f	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.182.194	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.715765953 CET	8.8.8.8	192.168.2.4	0x390f	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.19.252.36	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.715765953 CET	8.8.8.8	192.168.2.4	0x390f	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.225.66.103	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.715765953 CET	8.8.8.8	192.168.2.4	0x390f	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.142.93	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.715765953 CET	8.8.8.8	192.168.2.4	0x390f	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.243.164.148	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.715765953 CET	8.8.8.8	192.168.2.4	0x390f	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.126.66	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.766254902 CET	8.8.8.8	192.168.2.4	0xd2a2	No error (0)	api.ipify.org	nagano-19599.herokussl.com		CNAME (Canonical name)	IN (0x0001)
Nov 20, 2020 20:06:02.766254902 CET	8.8.8.8	192.168.2.4	0xd2a2	No error (0)	nagano-19599.herokussl.com	elb097307-934924932.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Nov 20, 2020 20:06:02.766254902 CET	8.8.8.8	192.168.2.4	0xd2a2	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.83.248	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.766254902 CET	8.8.8.8	192.168.2.4	0xd2a2	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		174.129.214.20	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.766254902 CET	8.8.8.8	192.168.2.4	0xd2a2	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.182.194	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.766254902 CET	8.8.8.8	192.168.2.4	0xd2a2	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		50.19.252.36	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.766254902 CET	8.8.8.8	192.168.2.4	0xd2a2	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.225.66.103	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.766254902 CET	8.8.8.8	192.168.2.4	0xd2a2	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.235.142.93	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.766254902 CET	8.8.8.8	192.168.2.4	0xd2a2	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		54.243.164.148	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:02.766254902 CET	8.8.8.8	192.168.2.4	0xd2a2	No error (0)	elb097307-934924932.us-east-1.elb.amazonaws.com		23.21.126.66	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:11.864727974 CET	8.8.8.8	192.168.2.4	0x6c4	No error (0)	smtp.tzdieep.net	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Nov 20, 2020 20:06:11.864727974 CET	8.8.8.8	192.168.2.4	0x6c4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:11.864727974 CET	8.8.8.8	192.168.2.4	0x6c4	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:11.864727974 CET	8.8.8.8	192.168.2.4	0x6c4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:11.864727974 CET	8.8.8.8	192.168.2.4	0x6c4	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:12.043437004 CET	8.8.8.8	192.168.2.4	0xa6f5	No error (0)	smtp.tzdieep.net	us2.smtp.mailhostbox.com		CNAME (Canonical name)	IN (0x0001)
Nov 20, 2020 20:06:12.043437004 CET	8.8.8.8	192.168.2.4	0xa6f5	No error (0)	us2.smtp.mailhostbox.com		208.91.198.143	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:12.043437004 CET	8.8.8.8	192.168.2.4	0xa6f5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.224	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:12.043437004 CET	8.8.8.8	192.168.2.4	0xa6f5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.225	A (IP address)	IN (0x0001)
Nov 20, 2020 20:06:12.043437004 CET	8.8.8.8	192.168.2.4	0xa6f5	No error (0)	us2.smtp.mailhostbox.com		208.91.199.223	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 20, 2020 20:06:03.152462959 CET	54.235.83.248	443	192.168.2.4	49765	CN=*.ipify.org, OU=PositiveSSL Wildcard, OU=Domain Control Validated CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Jan 24 01:00:00 CET 2018 Wed Feb 12 01:00:00 CET 2014 Tue Jan 19 01:00:00 CET 2010	Sun Jan 24 00:59:59 CET 2021 Mon Feb 12 00:59:59 CET 2029 Tue Jan 19 00:59:59 CET 2038	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	3b5074b1b5d032e5620f69f9f700ff0e
					CN=COMODO RSA Domain Validation Secure Server CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Wed Feb 12 01:00:00 CET 2014	Mon Feb 12 00:59:59 CET 2029
					CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Jan 19 01:00:00 CET 2010	Tue Jan 19 00:59:59 CET 2038

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 20, 2020 20:06:12.812896967 CET	587	49766	208.91.199.225	192.168.2.4	220 us2.outbound.mailhostbox.com ESMTP Postfix
Nov 20, 2020 20:06:12.813532114 CET	49766	587	192.168.2.4	208.91.199.225	EHLO 928100
Nov 20, 2020 20:06:12.963083982 CET	587	49766	208.91.199.225	192.168.2.4	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN
Nov 20, 2020 20:06:12.965086937 CET	49766	587	192.168.2.4	208.91.199.225	AUTH login c2FsZXMxQHR6ZGllZXAubmV0
Nov 20, 2020 20:06:13.117259979 CET	587	49766	208.91.199.225	192.168.2.4	334 UGFzc3dvcmQ6
Nov 20, 2020 20:06:13.272712946 CET	587	49766	208.91.199.225	192.168.2.4	235 2.7.0 Authentication successful
Nov 20, 2020 20:06:13.273732901 CET	49766	587	192.168.2.4	208.91.199.225	MAIL FROM:<sales1@tzdieep.net>
Nov 20, 2020 20:06:13.426875114 CET	587	49766	208.91.199.225	192.168.2.4	250 2.1.0 Ok
Nov 20, 2020 20:06:13.427592993 CET	49766	587	192.168.2.4	208.91.199.225	RCPT TO:<sales1@tzdieep.net>
Nov 20, 2020 20:06:13.587024927 CET	587	49766	208.91.199.225	192.168.2.4	250 2.1.5 Ok
Nov 20, 2020 20:06:13.587740898 CET	49766	587	192.168.2.4	208.91.199.225	DATA
Nov 20, 2020 20:06:13.900435925 CET	49766	587	192.168.2.4	208.91.199.225	DATA
Nov 20, 2020 20:06:13.970786095 CET	587	49766	208.91.199.225	192.168.2.4	250 2.1.5 Ok
Nov 20, 2020 20:06:14.052644968 CET	587	49766	208.91.199.225	192.168.2.4	354 End data with <CR><LF>.<CR><LF>
Nov 20, 2020 20:06:14.054862022 CET	49766	587	192.168.2.4	208.91.199.225	.
Nov 20, 2020 20:06:14.304539919 CET	587	49766	208.91.199.225	192.168.2.4	250 2.0.0 Ok: queued as 7CC42D5F69
Nov 20, 2020 20:06:15.132817984 CET	49766	587	192.168.2.4	208.91.199.225	QUIT
Nov 20, 2020 20:06:15.285135031 CET	587	49766	208.91.199.225	192.168.2.4	221 2.0.0 Bye
Nov 20, 2020 20:06:18.597949028 CET	587	49767	208.91.199.225	192.168.2.4	220 us2.outbound.mailhostbox.com ESMTP Postfix
Nov 20, 2020 20:06:18.598503113 CET	49767	587	192.168.2.4	208.91.199.225	EHLO 928100
Nov 20, 2020 20:06:18.750929117 CET	587	49767	208.91.199.225	192.168.2.4	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250 DSN
Nov 20, 2020 20:06:18.751543045 CET	49767	587	192.168.2.4	208.91.199.225	AUTH login c2FsZXMxQHR6ZGllZXAubmV0
Nov 20, 2020 20:06:18.905124903 CET	587	49767	208.91.199.225	192.168.2.4	334 UGFzc3dvcmQ6
Nov 20, 2020 20:06:19.059966087 CET	587	49767	208.91.199.225	192.168.2.4	235 2.7.0 Authentication successful
Nov 20, 2020 20:06:19.060359955 CET	49767	587	192.168.2.4	208.91.199.225	MAIL FROM:<sales1@tzdieep.net>
Nov 20, 2020 20:06:19.213042021 CET	587	49767	208.91.199.225	192.168.2.4	250 2.1.0 Ok
Nov 20, 2020 20:06:19.213613987 CET	49767	587	192.168.2.4	208.91.199.225	RCPT TO:<sales1@tzdieep.net>
Nov 20, 2020 20:06:19.372828960 CET	587	49767	208.91.199.225	192.168.2.4	250 2.1.5 Ok
Nov 20, 2020 20:06:19.373275995 CET	49767	587	192.168.2.4	208.91.199.225	DATA
Nov 20, 2020 20:06:19.526504993 CET	587	49767	208.91.199.225	192.168.2.4	354 End data with <CR><LF>.<CR><LF>
Nov 20, 2020 20:06:19.530380964 CET	49767	587	192.168.2.4	208.91.199.225	.
Nov 20, 2020 20:06:19.782569885 CET	587	49767	208.91.199.225	192.168.2.4	250 2.0.0 Ok: queued as 484E9D6132

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: mcsrXx9lfD.exe PID: 7076 Parent PID: 5880

General

Start time:	20:04:29
Start date:	20/11/2020
Path:	C:\Users\user\Desktop\mcsrXx9lfD.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\mcsrXx9lfD.exe'
Imagebase:	0x400000
File size:	945664 bytes
MD5 hash:	3D549885E44863C57F59EAB47F2271CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.680903753.000000000267B000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.680869571.0000000002632000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.680813500.00000000025E0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: mcsrXx9lfD.exe PID: 7100 Parent PID: 7076

General

Start time:	20:04:30
Start date:	20/11/2020
Path:	C:\Users\user\Desktop\mcsrXx9lfD.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\mcsrXx9lfD.exe'
Imagebase:	0x400000
File size:	945664 bytes
MD5 hash:	3D549885E44863C57F59EAB47F2271CC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.946404123.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000001.679937947.000000000044B000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.946830924.0000000000792000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.947178259.0000000000B22000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.946449899.000000000044B000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.946663757.0000000000630000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.948044914.00000000029B5000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.947961808.0000000002961000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.948310266.0000000002BC2000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report mcsrXx9lfD.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

SMTP Packets

Code Manipulations

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre